It seems that at S3DF kubernetes, a loadbalancer can not be on address pool sdf-dmz and use
ExternalTrafficPolicy:Local at the same time. This combination will result in the
services exported by the loadbalancer not accessible from anywhere. So far this seems to be a bug
at S3DF Kubernetes.
ExternalTrafficPolicy:Local will allow the service to see clients' IP addresses.
The redirector xrootd service needs be on the sdf-dmz network but doesn't need to see the clients'
(external users) IP addresses. The cmsd service needs to see its clients' (data server nodes) IP addresses.
But it doesn't need to be on the sdf-dmz. It can be on the sdf-services address pool (not accessible
from outside). These two characteristics provide an opportunity to use two different loadbalaners to separately
export xrootd service and cmsd service.
This redirector is intended to work with several data servers that export the same shared file system.
For this reason, the cms.dfs directive is used.
To upload secrets (hostcert, hostkey and macaroon) to S3DF vault, run sh upload-secrets.sh.
To deploy services, (please pay attend to the kubeconfig file and namespace, and then) run
make apply
kubectl --kubeconfig ... -n ... apply -f configmap.yaml
kubectl --kubeconfig ... -n ... apply -f services.yaml
kubectl --kubeconfig ... -n ... apply -f pvc.yaml
kubectl --kubeconfig ... -n ... apply -f deployment.yaml
All deployments have the same common lable "app:xrdrdr". This is used by the affinity: block in each
deployment yaml to force all pods to run on the same host. Running the pods on the same k8s host is
needed for the cmsd loadbalancer becuase it is configured to serve two ports to pods, and has to use
"externalTrafficPolicy: Local".