Fix multiple issues with servicelb

pkg/cloudprovider/servicelb.go

@@ -52,7 +52,7 @@ const (
 )
 
 var (
-	DefaultLBImage = "rancher/klipper-lb:v0.4.7"
+	DefaultLBImage = "rancher/klipper-lb:v0.4.9"
 )
 
 func (k *k3s) Register(ctx context.Context,
@@ -437,12 +437,19 @@ func (k *k3s) newDaemonSet(svc *core.Service) (*apps.DaemonSet, error) {
 		return nil, err
 	}
 	sourceRanges := strings.Join(sourceRangesSet.StringSlice(), ",")
+	securityContext := &core.PodSecurityContext{}
 
 	for _, ipFamily := range svc.Spec.IPFamilies {
-		if ipFamily == core.IPv6Protocol && sourceRanges == "0.0.0.0/0" {
-			// The upstream default load-balancer source range only includes IPv4, even if the service is IPv6-only or dual-stack.
-			// If using the default range, and IPv6 is enabled, also allow IPv6.
-			sourceRanges += ",::/0"
+		switch ipFamily {
+		case core.IPv4Protocol:
+			securityContext.Sysctls = append(securityContext.Sysctls, core.Sysctl{Name: "net.ipv4.ip_forward", Value: "1"})
+		case core.IPv6Protocol:
+			securityContext.Sysctls = append(securityContext.Sysctls, core.Sysctl{Name: "net.ipv6.conf.all.forwarding", Value: "1"})
+			if sourceRanges == "0.0.0.0/0" {
+				// The upstream default load-balancer source range only includes IPv4, even if the service is IPv6-only or dual-stack.
+				// If using the default range, and IPv6 is enabled, also allow IPv6.
+				sourceRanges += ",::/0"
+			}
 		}
 	}
 
@@ -478,12 +485,7 @@ func (k *k3s) newDaemonSet(svc *core.Service) (*apps.DaemonSet, error) {
 					PriorityClassName:            priorityClassName,
 					ServiceAccountName:           "svclb",
 					AutomountServiceAccountToken: utilsptr.To(false),
-					SecurityContext: &core.PodSecurityContext{
-						Sysctls: []core.Sysctl{
-							{Name: "net.ipv4.ip_forward", Value: "1"},
-							{Name: "net.ipv6.conf.all.forwarding", Value: "1"},
-						},
-					},
+					SecurityContext:              securityContext,
 					Tolerations: []core.Toleration{
 						{
 							Key:      util.MasterRoleLabelKey,
@@ -699,7 +701,17 @@ func (k *k3s) getPriorityClassName(svc *core.Service) string {
 
 // generateName generates a distinct name for the DaemonSet based on the service name and UID
 func generateName(svc *core.Service) string {
-	return fmt.Sprintf("svclb-%s-%s", svc.Name, svc.UID[:8])
+	name := svc.Name
+	// ensure that the service name plus prefix and uuid aren't overly long, but
+	// don't cut the service name at a trailing hyphen.
+	if len(name) > 48 {
+		trimlen := 48
+		for name[trimlen-1] == '-' {
+			trimlen--
+		}
+		name = name[0:trimlen]
+	}
+	return fmt.Sprintf("svclb-%s-%s", name, svc.UID[:8])
 }
 
 // ingressToString converts a list of LoadBalancerIngress entries to strings

pkg/cloudprovider/servicelb_test.go

@@ -6,6 +6,8 @@ import (
 	"testing"
 
 	core "k8s.io/api/core/v1"
+	meta "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
 )
 
 const (
@@ -111,3 +113,50 @@ func Test_UnitFilterByIPFamily_Ordering(t *testing.T) {
 		t.Errorf("filterByIPFamily() = %+v\nWant = %+v", got, want)
 	}
 }
+
+func Test_UnitGenerateName(t *testing.T) {
+	uid := types.UID("35a5ccb3-4a82-40b7-8d83-cda9582e4251")
+	tests := []struct {
+		name string
+		svc  *core.Service
+		want string
+	}{
+		{
+			name: "Short name",
+			svc: &core.Service{
+				ObjectMeta: meta.ObjectMeta{
+					Name: "a-service",
+					UID:  uid,
+				},
+			},
+			want: "svclb-a-service-35a5ccb3",
+		},
+		{
+			name: "Long name",
+			svc: &core.Service{
+				ObjectMeta: meta.ObjectMeta{
+					Name: "a-service-with-a-very-veeeeeery-long-yet-valid-name",
+					UID:  uid,
+				},
+			},
+			want: "svclb-a-service-with-a-very-veeeeeery-long-yet-valid-n-35a5ccb3",
+		},
+		{
+			name: "Long hypenated name",
+			svc: &core.Service{
+				ObjectMeta: meta.ObjectMeta{
+					Name: "a-service-with-a-name-with-inconvenient------------hypens",
+					UID:  uid,
+				},
+			},
+			want: "svclb-a-service-with-a-name-with-inconvenient-35a5ccb3",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := generateName(tt.svc); got != tt.want {
+				t.Errorf("generateName() = %+v\nWant = %+v", got, tt.want)
+			}
+		})
+	}
+}

scripts/airgap/image-list.txt

@@ -1,5 +1,5 @@
 docker.io/rancher/klipper-helm:v0.8.4-build20240523
-docker.io/rancher/klipper-lb:v0.4.7
+docker.io/rancher/klipper-lb:v0.4.9
 docker.io/rancher/local-path-provisioner:v0.0.28
 docker.io/rancher/mirrored-coredns-coredns:1.10.1
 docker.io/rancher/mirrored-library-busybox:1.36.1