Allow workload cluster API LB frontend port to be configured distinctively from apiserver listen port

[tuommaki]

Goals

1. Allow distinct configuration of API LB frontend port from apiserver listen port.
2. Maintain current behavior to default with apiserver listen port when control plane endpoint port has not been defined.

User Story

As an operator I would like to configure different port to public facing API LB frontend port than what workload cluster's k8s apiserver uses as listen port.

Detailed Description

As an operator I want API LB frontend port to listen in default HTTPS port (443) while workload cluster's control plane nodes have kubernetes apiserver bound in non-privileged default port 6443.

Contract changes [optional]

If Cluster.Spec.ControlPlaneEndpoint.Port has been defined, it's used for API LB frontend port configuration. If it is not defined, API LB frontend port defaults to workload cluster kubernetes apiserver listen port as it is used now.

Data model changes [optional]

No changes to data model is needed for this feature.

/kind proposal

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale

[tuommaki]

We haven't had a need for this now and since there wasn't any other traction on this, I'll close this ticket.

[dmeytin]

Hey Tuomas,
If I remember correctly, reusing the same port has caused the workload that is running on master nodes and performs communication with k8s api servers to fail when the same node where the instance is running was accessed.
Was this use-case validated?