add HCLOUD_LOAD_BALANCERS_SERVICES_SELECTOR for selecting services

Dockerfile

@@ -1,4 +1,11 @@
-FROM alpine:3.20
+FROM --platform=linux/amd64 golang:1.22.0-alpine AS builder
+
+WORKDIR /builder
+COPY ./ /builder
+
+RUN go build -o hcloud-cloud-controller-manager main.go
+
+FROM --platform=linux/amd64 alpine:3.20
 RUN apk add --no-cache ca-certificates bash
-COPY hcloud-cloud-controller-manager /bin/hcloud-cloud-controller-manager
-ENTRYPOINT ["/bin/hcloud-cloud-controller-manager"]
+COPY --from=builder /builder/hcloud-cloud-controller-manager /bin/
+

hcloud/cloud.go

@@ -171,7 +171,7 @@ func (c *cloud) LoadBalancer() (cloudprovider.LoadBalancer, bool) {
 		Recorder:      c.recorder,
 	}
 
-	return newLoadBalancers(lbOps, c.cfg.LoadBalancer.DisablePrivateIngress, c.cfg.LoadBalancer.DisableIPv6), true
+	return newLoadBalancers(lbOps, c.cfg.LoadBalancer.DisablePrivateIngress, c.cfg.LoadBalancer.DisableIPv6, c.cfg.LoadBalancer.ServiceSelector), true
 }
 
 func (c *cloud) Clusters() (cloudprovider.Clusters, bool) {

hcloud/load_balancers.go

@@ -33,16 +33,30 @@ type loadBalancers struct {
 	lbOps                        LoadBalancerOps
 	disablePrivateIngressDefault bool
 	disableIPv6Default           bool
+	serviceSelector              string
 }
 
-func newLoadBalancers(lbOps LoadBalancerOps, disablePrivateIngressDefault bool, disableIPv6Default bool) *loadBalancers {
+func newLoadBalancers(lbOps LoadBalancerOps, disablePrivateIngressDefault bool, disableIPv6Default bool, serviceSelector string) *loadBalancers {
 	return &loadBalancers{
 		lbOps:                        lbOps,
 		disablePrivateIngressDefault: disablePrivateIngressDefault,
 		disableIPv6Default:           disableIPv6Default,
+		serviceSelector:              serviceSelector,
 	}
 }
 
+func matchServiceSelector(svc *corev1.Service, serviceSelector string) (bool, error) {
+	var (
+		err      error
+		selector = labels.Everything()
+	)
+	selector, err = labels.Parse(serviceSelector)
+	if err != nil {
+		return false, fmt.Errorf("unable to parse the service-selector: %w", err)
+	}
+	return selector.Matches(labels.Set(svc.GetLabels())), nil
+}
+
 func matchNodeSelector(svc *corev1.Service, nodes []*corev1.Node) ([]*corev1.Node, error) {
 	var (
 		err           error
@@ -114,6 +128,15 @@ func (l *loadBalancers) EnsureLoadBalancer(
 		selectedNodes []*corev1.Node
 	)
 
+	if matched, err := matchServiceSelector(svc, l.serviceSelector); err != nil {
+		return nil, fmt.Errorf("%s: %w", op, err)
+	} else if !matched {
+		klog.InfoS("service ignored by selector", "service", svc.Name, "selector", l.serviceSelector, "op", op)
+		return &svc.Status.LoadBalancer, nil
+	} else {
+		klog.InfoS("service accepted by selector", "service", svc.Name, "selector", l.serviceSelector, "op", op)
+	}
+
 	selectedNodes, err = matchNodeSelector(svc, nodes)
 	if err != nil {
 		return nil, fmt.Errorf("%s: %w", op, err)
@@ -265,6 +288,15 @@ func (l *loadBalancers) UpdateLoadBalancer(
 	const op = "hcloud/loadBalancers.UpdateLoadBalancer"
 	metrics.OperationCalled.WithLabelValues(op).Inc()
 
+	if matched, err := matchServiceSelector(svc, l.serviceSelector); err != nil {
+		return fmt.Errorf("%s: %w", op, err)
+	} else if !matched {
+		klog.InfoS("service ignored by selector", "service", svc.Name, "selector", l.serviceSelector, "op", op)
+		return nil
+	} else {
+		klog.InfoS("service accepted by selector", "service", svc.Name, "selector", l.serviceSelector, "op", op)
+	}
+
 	var (
 		lb            *hcloud.LoadBalancer
 		err           error
@@ -312,6 +344,15 @@ func (l *loadBalancers) EnsureLoadBalancerDeleted(ctx context.Context, _ string,
 	const op = "hcloud/loadBalancers.EnsureLoadBalancerDeleted"
 	metrics.OperationCalled.WithLabelValues(op).Inc()
 
+	if matched, err := matchServiceSelector(service, l.serviceSelector); err != nil {
+		return fmt.Errorf("%s: %w", op, err)
+	} else if !matched {
+		klog.InfoS("service ignored by selector", "service", service.Name, "selector", l.serviceSelector, "op", op)
+		return nil
+	} else {
+		klog.InfoS("service accepted by selector", "service", service.Name, "selector", l.serviceSelector, "op", op)
+	}
+
 	loadBalancer, err := l.lbOps.GetByK8SServiceUID(ctx, service)
 	if errors.Is(err, hcops.ErrNotFound) {
 		return nil

hcloud/testing.go

@@ -69,7 +69,7 @@ func (tt *LoadBalancerTestCase) run(t *testing.T) {
 		tt.Mock(t, tt)
 	}
 
-	tt.LoadBalancers = newLoadBalancers(tt.LBOps, tt.DisablePrivateIngressDefault, tt.DisableIPv6Default)
+	tt.LoadBalancers = newLoadBalancers(tt.LBOps, tt.DisablePrivateIngressDefault, tt.DisableIPv6Default, "")
 	tt.Perform(t, tt)
 
 	tt.LBOps.AssertExpectations(t)

internal/config/config.go

@@ -30,6 +30,7 @@ const (
 
 	hcloudLoadBalancersEnabled               = "HCLOUD_LOAD_BALANCERS_ENABLED"
 	hcloudLoadBalancersLocation              = "HCLOUD_LOAD_BALANCERS_LOCATION"
+	hcloudLoadBalancersServicesSelector      = "HCLOUD_LOAD_BALANCERS_SERVICES_SELECTOR"
 	hcloudLoadBalancersNetworkZone           = "HCLOUD_LOAD_BALANCERS_NETWORK_ZONE"
 	hcloudLoadBalancersDisablePrivateIngress = "HCLOUD_LOAD_BALANCERS_DISABLE_PRIVATE_INGRESS"
 	hcloudLoadBalancersUsePrivateIP          = "HCLOUD_LOAD_BALANCERS_USE_PRIVATE_IP"
@@ -74,6 +75,7 @@ type LoadBalancerConfiguration struct {
 	Enabled               bool
 	Location              string
 	NetworkZone           string
+	ServiceSelector       string
 	DisablePrivateIngress bool
 	UsePrivateIP          bool
 	DisableIPv6           bool
@@ -160,6 +162,8 @@ func Read() (HCCMConfiguration, error) {
 	}
 	cfg.LoadBalancer.Location = os.Getenv(hcloudLoadBalancersLocation)
 	cfg.LoadBalancer.NetworkZone = os.Getenv(hcloudLoadBalancersNetworkZone)
+	cfg.LoadBalancer.ServiceSelector = os.Getenv(hcloudLoadBalancersServicesSelector)
+
 	cfg.LoadBalancer.DisablePrivateIngress, err = getEnvBool(hcloudLoadBalancersDisablePrivateIngress, false)
 	if err != nil {
 		errs = append(errs, err)