OpenStack integrator does not configure Neutron address pairs for LB VIPs or use a native LBaaSv2/Octavia for API load-balancing

[Dmitrii Shcherbakov]

In order to use a virtual IPs for kube-api-loadbalancer (either with keepalived or with charm-hacluster) OpenStack integrator needs to set up Neutron such that it does not block VIP traffic for all ports of VMs that host kubeapi-load-balancer.

openstack port set <vm_port_uuid> --allowed-address <vip>

https://docs.openstack.org/python-openstackclient/queens/cli/command-objects/port.html#cmdoption-port-create-allowed-address

Alternatively (or in addition to that), LBaaS or Octavia could be utilized to load-balance Kubernetes master traffic instead.

[Nobuto Murata (nobuto)]

This might/should be Juju's responsibility since that vip may need to be accessible for some hook executions. Relying on other charms such as openstack-integrator to modify the address pair may bring another race condition.

[George Kraft (cynerva)]

The current recommendation is to relate kubernetes-master:loadbalancer to openstack-integrator instead of kubeapi-load-balancer. When this is done, openstack-integrator will create a native OpenStack load balancer for the Kubernetes API. I believe that covers this use case.

See an example bundle here: https://ubuntu.com/kubernetes/docs/openstack-integration