test

.github/ISSUE_TEMPLATE/bug_report.md

@@ -2,23 +2,73 @@
 name: Bug report
 about: Create a report to help us improve
 title: ''
-labels: bug
+labels: ''
 assignees: ''
 
 ---
 
-**Describe the bug**
-A concise description of what the bug is.
+<!--- ❤️ Thanks for taking the time to report this issue. Before you open an issue, please check if a similar issue [already exists](https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues) or has been closed before. If so, add additional helpful details to the existing issue to show that it's affecting multiple people. If not, to help us investigate, please provide the following information. ❤️-->
 
-**Steps to reproduce**
+<!-- 🚨 IMPORTANT!!!
+Please complete at least the following sections
+- Bug Description
+- Steps to Reproduce
+- Expected Behavior
+- Environment 
+Issue missing details will be closed, as they are crucial for understand the problem. 🚨 -->
 
-**Expected outcome**
-A concise description of what you expected to happen.
+**Bug Description**
+<!--- A concise description of what the bug is -->
+
+**Steps to Reproduce**
+<!--- Provide a step-by-step guide to reproduce the bug. If relevant, provide the controller logs with any error messages you are seeing and relevant Kubernetes Manifests.-->
+- Step-by-step guide to reproduce the bug:
+- Manifests applied while reproducing the issue:
+- Controller logs/error messages while reproducing the issue:
+
+**Expected Behavior**
+<!--- Describe what you expected to happen instead of the observed behavior -->
+
+**Actual Behavior**
+<!--- Describe what actually happens, including details on 
+- whether the bug causes the controller to stop working entirely or impact some functionality
+- how often this bug occur ? [e.g., Always / Often / Occasionally / Rarely]
+-->
+
+**Regression**
+Was the functionality working correctly in a previous version ? [Yes / No]
+If yes, specify the last version where it worked as expected
+
+**Current Workarounds**
+<!--- If any workarounds exist, describe them here. If none exist, state "No workarounds available" -->
 
 **Environment**
+- AWS Load Balancer controller version:
+- Kubernetes version:
+- Using EKS (yes/no), if so version?:
+- Using Service or Ingress:
+- AWS region:
+- How was the aws-load-balancer-controller installed:
+  - If helm was used then please show output of `helm ls -A | grep -i aws-load-balancer-controller`
+  - If helm was used then please show output of `helm -n <controllernamespace> get values <helmreleasename>`
+  - If helm was not used, then copy/paste the exact command used to install the controller, including flags and options.
+- Current state of the Controller configuration:
+  - `kubectl -n <controllernamespace> describe deployment aws-load-balancer-controller`
+- Current state of the Ingress/Service configuration:
+  - `kubectl describe ingressclasses`
+  - `kubectl -n <appnamespace> describe ingress <ingressname>`
+  - `kubectl -n <appnamespace> describe svc <servicename>`
+
+**Possible Solution (Optional)**
+<!--- If you have insights into the cause or potential fix, please share them. -->
 
-* AWS Load Balancer controller version
-* Kubernetes version
-* Using EKS (yes/no), if so version?
+**Contribution Intention (Optional)**
+<!---If the solution is accepted, would you be willing to submit a PR?
+- if yes, please follow https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/CONTRIBUTING.md to start your contribution.
+- If you're not able to contribute a fix, the issue will be open for public contribution. High-impact issues will receive priority attention. We encourage community participation to help resolve issues faster. 
+-->
+- [ ] Yes, I'm willing to submit a PR to fix this issue
+- [ ] No, I cannot work on a PR at this time
 
-**Additional Context**:
+**Additional Context**
+<!---Add any other context about the problem here.-->

.github/ISSUE_TEMPLATE/feature_request.md

@@ -2,16 +2,29 @@
 name: Feature request
 about: Suggest an idea for this project
 title: ''
-labels: enhancement
+labels: ''
 assignees: ''
 
 ---
 
-**Is your feature request related to a problem?**
-A description of what the problem is. For example: I'm frustrated when [...]
+<!--- ❤️ Thanks for taking the time to fill out this feature request report! We kindly ask that you search to see if a feature request [already exists](https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues?q=is%3Aissue%20state%3Aopen%20label%3Akind%2Ffeature) for your feature.  If yes, show your support for features by up voting a discussion or by adding meaningful details which help the feature definition become more clear. If not, please provide following details to have the greatest chance of being worked on by a contributor. ❤️-->
 
-**Describe the solution you'd like**
-A description of what you want to happen.
+**Describe the feature you are requesting**
+<!--- Provide a clear and concise description of the feature -->
+
+**Motivation**
+<!--- Provide context about how it will benefit users or improve the project overall. -->
+
+**Describe the proposed solution you'd like**
+<!--- A description of what you want to happen. -->
 
 **Describe alternatives you've considered**
-A description of any alternative solutions or features you've considered.
+<!--- A description of any alternative solutions or features you've considered. -->
+
+**Contribution Intention (Optional)**
+<!--- If the feature request is accepted, would you be willing to submit a PR?
+* If yes, please follow https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/CONTRIBUTING.md to start your contribution
+* If you're not able to contribute this feature, it will be open for public contribution. Feature requests are prioritized by the number of upvotes. We encourage community participation to help implement features faster. 
+-->
+-[ ] Yes, I am willing to contribute a PR to implement this feature
+-[ ] No, I cannot work on a PR at this time

.go-version

@@ -1 +1 @@
-1.22.8
+1.23.6

apis/elbv2/v1alpha1/targetgroupbinding_types.go

@@ -128,6 +128,14 @@ type TargetGroupBindingSpec struct {
 	// networking provides the networking setup for ELBV2 LoadBalancer to access targets in TargetGroup.
 	// +optional
 	Networking *TargetGroupBindingNetworking `json:"networking,omitempty"`
+
+	// IAM Role ARN to assume when calling AWS APIs. Useful if the target group is in a different AWS account
+	// +optional
+	IamRoleArnToAssume string `json:"iamRoleArnToAssume,omitempty"`
+
+	// IAM Role ARN to assume when calling AWS APIs. Needed to assume a role in another account and prevent the confused deputy problem. https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html
+	// +optional
+	AssumeRoleExternalId string `json:"assumeRoleExternalId,omitempty"`
 }
 
 // TargetGroupBindingStatus defines the observed state of TargetGroupBinding

apis/elbv2/v1beta1/targetgroupbinding_types.go

@@ -157,6 +157,14 @@ type TargetGroupBindingSpec struct {
 	// VpcID is the VPC of the TargetGroup. If unspecified, it will be automatically inferred.
 	// +optional
 	VpcID string `json:"vpcID,omitempty"`
+
+	// IAM Role ARN to assume when calling AWS APIs. Useful if the target group is in a different AWS account
+	// +optional
+	IamRoleArnToAssume string `json:"iamRoleArnToAssume,omitempty"`
+
+	// IAM Role ARN to assume when calling AWS APIs. Needed to assume a role in another account and prevent the confused deputy problem. https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html
+	// +optional
+	AssumeRoleExternalId string `json:"assumeRoleExternalId,omitempty"`
 }
 
 // TargetGroupBindingStatus defines the observed state of TargetGroupBinding

config/crd/bases/elbv2.k8s.aws_targetgroupbindings.yaml

@@ -65,6 +65,15 @@ spec:
           spec:
             description: TargetGroupBindingSpec defines the desired state of TargetGroupBinding
             properties:
+              assumeRoleExternalId:
+                description: IAM Role ARN to assume when calling AWS APIs. Needed
+                  to assume a role in another account and prevent the confused deputy
+                  problem. https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html
+                type: string
+              iamRoleArnToAssume:
+                description: IAM Role ARN to assume when calling AWS APIs. Useful
+                  if the target group is in a different AWS account
+                type: string
               multiClusterTargetGroup:
                 description: MultiClusterTargetGroup Denotes if the TargetGroup is
                   shared among multiple clusters
@@ -242,6 +251,15 @@ spec:
           spec:
             description: TargetGroupBindingSpec defines the desired state of TargetGroupBinding
             properties:
+              assumeRoleExternalId:
+                description: IAM Role ARN to assume when calling AWS APIs. Needed
+                  to assume a role in another account and prevent the confused deputy
+                  problem. https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html
+                type: string
+              iamRoleArnToAssume:
+                description: IAM Role ARN to assume when calling AWS APIs. Useful
+                  if the target group is in a different AWS account
+                type: string
               ipAddressType:
                 description: ipAddressType specifies whether the target group is of
                   type IPv4 or IPv6. If unspecified, it will be automatically inferred.

config/webhook/manifests.yaml

@@ -11,7 +11,7 @@ webhooks:
         name: webhook-service
         namespace: system
         path: /mutate-v1-pod
-    failurePolicy: Fail
+    failurePolicy: Ignore
     name: mpod.elbv2.k8s.aws
     rules:
       - apiGroups:

controllers/elbv2/eventhandlers/endpoints.go

@@ -33,13 +33,13 @@ type enqueueRequestsForEndpointsEvent struct {
 }
 
 // Create is called in response to an create event - e.g. Pod Creation.
-func (h *enqueueRequestsForEndpointsEvent) Create(ctx context.Context, e event.CreateEvent, queue workqueue.RateLimitingInterface) {
+func (h *enqueueRequestsForEndpointsEvent) Create(ctx context.Context, e event.CreateEvent, queue workqueue.TypedRateLimitingInterface[reconcile.Request]) {
 	epNew := e.Object.(*corev1.Endpoints)
 	h.enqueueImpactedTargetGroupBindings(queue, epNew)
 }
 
 // Update is called in response to an update event -  e.g. Pod Updated.
-func (h *enqueueRequestsForEndpointsEvent) Update(ctx context.Context, e event.UpdateEvent, queue workqueue.RateLimitingInterface) {
+func (h *enqueueRequestsForEndpointsEvent) Update(ctx context.Context, e event.UpdateEvent, queue workqueue.TypedRateLimitingInterface[reconcile.Request]) {
 	epOld := e.ObjectOld.(*corev1.Endpoints)
 	epNew := e.ObjectNew.(*corev1.Endpoints)
 	if !equality.Semantic.DeepEqual(epOld.Subsets, epNew.Subsets) {
@@ -48,17 +48,17 @@ func (h *enqueueRequestsForEndpointsEvent) Update(ctx context.Context, e event.U
 }
 
 // Delete is called in response to a delete event - e.g. Pod Deleted.
-func (h *enqueueRequestsForEndpointsEvent) Delete(ctx context.Context, e event.DeleteEvent, queue workqueue.RateLimitingInterface) {
+func (h *enqueueRequestsForEndpointsEvent) Delete(ctx context.Context, e event.DeleteEvent, queue workqueue.TypedRateLimitingInterface[reconcile.Request]) {
 	epOld := e.Object.(*corev1.Endpoints)
 	h.enqueueImpactedTargetGroupBindings(queue, epOld)
 }
 
 // Generic is called in response to an event of an unknown type or a synthetic event triggered as a cron or
 // external trigger request - e.g. reconcile AutoScaling, or a WebHook.
-func (h *enqueueRequestsForEndpointsEvent) Generic(context.Context, event.GenericEvent, workqueue.RateLimitingInterface) {
+func (h *enqueueRequestsForEndpointsEvent) Generic(context.Context, event.GenericEvent, workqueue.TypedRateLimitingInterface[reconcile.Request]) {
 }
 
-func (h *enqueueRequestsForEndpointsEvent) enqueueImpactedTargetGroupBindings(queue workqueue.RateLimitingInterface, ep *corev1.Endpoints) {
+func (h *enqueueRequestsForEndpointsEvent) enqueueImpactedTargetGroupBindings(queue workqueue.TypedRateLimitingInterface[reconcile.Request], ep *corev1.Endpoints) {
 	tgbList := &elbv2api.TargetGroupBindingList{}
 	if err := h.k8sClient.List(context.Background(), tgbList,
 		client.InNamespace(ep.Namespace),

controllers/elbv2/eventhandlers/endpoints_test.go

@@ -2,6 +2,7 @@ package eventhandlers
 
 import (
 	"context"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"testing"
 
 	"github.com/go-logr/logr"
@@ -15,7 +16,6 @@ import (
 	elbv2api "sigs.k8s.io/aws-load-balancer-controller/apis/elbv2/v1beta1"
 	mock_client "sigs.k8s.io/aws-load-balancer-controller/mocks/controller-runtime/client"
 	"sigs.k8s.io/aws-load-balancer-controller/pkg/testutils"
-	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllertest"
 	"sigs.k8s.io/controller-runtime/pkg/log"
@@ -40,7 +40,7 @@ func Test_enqueueRequestsForEndpointsEvent_enqueueImpactedTargetGroupBindings(t
 		name         string
 		fields       fields
 		args         args
-		wantRequests []ctrl.Request
+		wantRequests []reconcile.Request
 	}{
 		{
 			name: "service event should enqueue impacted ip TargetType TGBs",
@@ -91,7 +91,7 @@ func Test_enqueueRequestsForEndpointsEvent_enqueueImpactedTargetGroupBindings(t
 					},
 				},
 			},
-			wantRequests: []ctrl.Request{
+			wantRequests: []reconcile.Request{
 				{
 					NamespacedName: types.NamespacedName{Namespace: "awesome-ns", Name: "tgb-1"},
 				},
@@ -140,7 +140,7 @@ func Test_enqueueRequestsForEndpointsEvent_enqueueImpactedTargetGroupBindings(t
 					},
 				},
 			},
-			wantRequests: []ctrl.Request{
+			wantRequests: []reconcile.Request{
 				{
 					NamespacedName: types.NamespacedName{Namespace: "awesome-ns", Name: "tgb-1"},
 				},
@@ -172,7 +172,7 @@ func Test_enqueueRequestsForEndpointsEvent_enqueueImpactedTargetGroupBindings(t
 				k8sClient: k8sClient,
 				logger:    logr.New(&log.NullLogSink{}),
 			}
-			queue := &controllertest.Queue{Interface: workqueue.New()}
+			queue := &controllertest.TypedQueue[reconcile.Request]{TypedInterface: workqueue.NewTyped[reconcile.Request]()}
 			h.enqueueImpactedTargetGroupBindings(queue, tt.args.eps)
 			gotRequests := testutils.ExtractCTRLRequestsFromQueue(queue)
 			assert.True(t, cmp.Equal(tt.wantRequests, gotRequests),

controllers/elbv2/eventhandlers/endpointslices.go

@@ -36,14 +36,14 @@ type enqueueRequestsForEndpointSlicesEvent struct {
 }
 
 // Create is called in response to an create event - e.g. EndpointSlice Creation.
-func (h *enqueueRequestsForEndpointSlicesEvent) Create(ctx context.Context, e event.CreateEvent, queue workqueue.RateLimitingInterface) {
+func (h *enqueueRequestsForEndpointSlicesEvent) Create(ctx context.Context, e event.CreateEvent, queue workqueue.TypedRateLimitingInterface[reconcile.Request]) {
 	epNew := e.Object.(*discv1.EndpointSlice)
 	h.logger.V(1).Info("Create event for EndpointSlices", "name", epNew.Name)
 	h.enqueueImpactedTargetGroupBindings(ctx, queue, epNew)
 }
 
 // Update is called in response to an update event -  e.g. EndpointSlice Updated.
-func (h *enqueueRequestsForEndpointSlicesEvent) Update(ctx context.Context, e event.UpdateEvent, queue workqueue.RateLimitingInterface) {
+func (h *enqueueRequestsForEndpointSlicesEvent) Update(ctx context.Context, e event.UpdateEvent, queue workqueue.TypedRateLimitingInterface[reconcile.Request]) {
 	epOld := e.ObjectOld.(*discv1.EndpointSlice)
 	epNew := e.ObjectNew.(*discv1.EndpointSlice)
 	h.logger.V(1).Info("Update event for EndpointSlices", "name", epNew.Name)
@@ -54,18 +54,18 @@ func (h *enqueueRequestsForEndpointSlicesEvent) Update(ctx context.Context, e ev
 }
 
 // Delete is called in response to a delete event - e.g. EndpointSlice Deleted.
-func (h *enqueueRequestsForEndpointSlicesEvent) Delete(ctx context.Context, e event.DeleteEvent, queue workqueue.RateLimitingInterface) {
+func (h *enqueueRequestsForEndpointSlicesEvent) Delete(ctx context.Context, e event.DeleteEvent, queue workqueue.TypedRateLimitingInterface[reconcile.Request]) {
 	epOld := e.Object.(*discv1.EndpointSlice)
 	h.logger.V(1).Info("Deletion event for EndpointSlices", "name", epOld.Name)
 	h.enqueueImpactedTargetGroupBindings(ctx, queue, epOld)
 }
 
 // Generic is called in response to an event of an unknown type or a synthetic event triggered as a cron or
 // external trigger request - e.g. reconcile AutoScaling, or a WebHook.
-func (h *enqueueRequestsForEndpointSlicesEvent) Generic(context.Context, event.GenericEvent, workqueue.RateLimitingInterface) {
+func (h *enqueueRequestsForEndpointSlicesEvent) Generic(context.Context, event.GenericEvent, workqueue.TypedRateLimitingInterface[reconcile.Request]) {
 }
 
-func (h *enqueueRequestsForEndpointSlicesEvent) enqueueImpactedTargetGroupBindings(ctx context.Context, queue workqueue.RateLimitingInterface, epSlice *discv1.EndpointSlice) {
+func (h *enqueueRequestsForEndpointSlicesEvent) enqueueImpactedTargetGroupBindings(ctx context.Context, queue workqueue.TypedRateLimitingInterface[reconcile.Request], epSlice *discv1.EndpointSlice) {
 	tgbList := &elbv2api.TargetGroupBindingList{}
 	svcName, present := epSlice.Labels[svcNameLabel]
 	if !present {

controllers/elbv2/eventhandlers/endpointslices_test.go

@@ -2,6 +2,7 @@ package eventhandlers
 
 import (
 	"context"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
 	"testing"
 
 	"github.com/go-logr/logr"
@@ -15,7 +16,6 @@ import (
 	elbv2api "sigs.k8s.io/aws-load-balancer-controller/apis/elbv2/v1beta1"
 	mock_client "sigs.k8s.io/aws-load-balancer-controller/mocks/controller-runtime/client"
 	"sigs.k8s.io/aws-load-balancer-controller/pkg/testutils"
-	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllertest"
 	"sigs.k8s.io/controller-runtime/pkg/log"
@@ -40,7 +40,7 @@ func Test_enqueueRequestsForEndpointSlicesEvent_enqueueImpactedTargetGroupBindin
 		name         string
 		fields       fields
 		args         args
-		wantRequests []ctrl.Request
+		wantRequests []reconcile.Request
 	}{
 		{
 			name: "service event should enqueue impacted ip TargetType TGBs",
@@ -92,7 +92,7 @@ func Test_enqueueRequestsForEndpointSlicesEvent_enqueueImpactedTargetGroupBindin
 					},
 				},
 			},
-			wantRequests: []ctrl.Request{
+			wantRequests: []reconcile.Request{
 				{
 					NamespacedName: types.NamespacedName{Namespace: "awesome-ns", Name: "tgb-1"},
 				},
@@ -142,7 +142,7 @@ func Test_enqueueRequestsForEndpointSlicesEvent_enqueueImpactedTargetGroupBindin
 					},
 				},
 			},
-			wantRequests: []ctrl.Request{
+			wantRequests: []reconcile.Request{
 				{
 					NamespacedName: types.NamespacedName{Namespace: "awesome-ns", Name: "tgb-1"},
 				},
@@ -174,7 +174,7 @@ func Test_enqueueRequestsForEndpointSlicesEvent_enqueueImpactedTargetGroupBindin
 				k8sClient: k8sClient,
 				logger:    logr.New(&log.NullLogSink{}),
 			}
-			queue := &controllertest.Queue{Interface: workqueue.New()}
+			queue := &controllertest.TypedQueue[reconcile.Request]{TypedInterface: workqueue.NewTyped[reconcile.Request]()}
 			h.enqueueImpactedTargetGroupBindings(context.Background(), queue, tt.args.epslice)
 			gotRequests := testutils.ExtractCTRLRequestsFromQueue(queue)
 			assert.True(t, cmp.Equal(tt.wantRequests, gotRequests),