IssueTracker

Problem you have encountered:
I have to set up an FTP server in a GCP Kubernetes cluster, and want to route clients so that multiple requests from the same IP to different ports get routed to the same Kubernetes pod.
However, when I set up a service of type load balancer with session affinity set to ClientIP, the requests get distributed to different nodes.

(Background)
In the (passive) FTP protocol, the server opens up a new port, and sends the port number to the client. The client then creates a new connection to that port. Hence, I need to ensure that the second request gets routed to the same pod, because only on that pod a server is waiting for a new connection.

What you expected to happen:
Subsequent requests from the same IP should get forwarded to the same pod.

Steps to reproduce:
I tried a minimal sample with a workload of two pods that have only a container with netcat installed, and have the ports 21, and 30000-30098 exposed. Then, I set up service of type LoadBalancer as follows (reduced to the relevant portions):

kind: Service
spec:
    type: LoadBalancer
    sessionAffinity: ClientIP
    loadBalancerIP: IP_OF_LB
    ports:
    - name: ftp-control
      port: 21
      protocol: TCP
      targetPort: 21
    - name: pasv-30000
      port: 30000
      protocol: TCP
      targetPort: 30000
      # and so on for the remaining ports up to 30098
Now I log onto each of the pods with a shell, and I start to listen manually on one port as follows:

netcat -l -p 30001
Then, I use telnet from my workstation to connect to the IP address of the load balancer.

telnet IP_OF_LB 30001
This way, I can see which pod gets the incoming connection request.

For each port, the requests always get forwarded to the same node, so the session affinity seems to work there. However, I would expect to be the target node to be stable across all ports.