clustermesh: explicitly validate service type, and forbid ClusterIP

Currently, the "clustermesh enable" command lists ClusterIP as one of the
supported service types. However, exposing the clustermesh-apiserver via
a ClusterIP service is hardly ever a sensible idea, as this component must
be reachable from other clusters. Still, this possibility has proved to
be sometimes confusing for newbie users, who ended up with a broken setup.

In an effort to prevent these problems, let's explicitly validate the
specified service type, and allow only NodePort and LoadBalancer
services. In any case, it is still possible to configure a service of
type ClusterIP via the helm chart in the handful of very advanced
use-cases (if any) which can actually work and benefit from it.

Signed-off-by: Marco Iorio <[email protected]>

cli/clustermesh.go

@@ -252,7 +252,7 @@ func newCmdClusterMeshEnableWithHelm() *cobra.Command {
 
 	cmd.Flags().BoolVar(&params.EnableExternalWorkloads, "enable-external-workloads", false, "Enable support for external workloads, such as VMs")
 	cmd.Flags().BoolVar(&params.EnableKVStoreMesh, "enable-kvstoremesh", false, "Enable kvstoremesh, an extension which caches remote cluster information in the local kvstore (Cilium >=1.14 only)")
-	cmd.Flags().StringVar(&params.ServiceType, "service-type", "", "Type of Kubernetes service to expose control plane { LoadBalancer | NodePort | ClusterIP }")
+	cmd.Flags().StringVar(&params.ServiceType, "service-type", "", "Type of Kubernetes service to expose control plane { LoadBalancer | NodePort }")
 
 	return cmd
 }

clustermesh/clustermesh.go

@@ -1478,7 +1478,10 @@ func generateEnableHelmValues(params Parameters, flavor k8s.Flavor) (map[string]
 	} else {
 		if corev1.ServiceType(params.ServiceType) == corev1.ServiceTypeNodePort {
 			log("⚠️  Using service type NodePort may fail when nodes are removed from the cluster!")
+		} else if corev1.ServiceType(params.ServiceType) != corev1.ServiceTypeLoadBalancer {
+			return nil, fmt.Errorf("service type %q is not valid", params.ServiceType)
 		}
+
 		helmVals["clustermesh"].(map[string]interface{})["apiserver"] = map[string]interface{}{
 			"service": map[string]interface{}{
 				"type": params.ServiceType,