third_party/com_k8s_io_kubernetes/k8s-reserve-metropolis-ports.patch

From 922898cb67ccedc6f0b67af9b398895d7fb55e56 Mon Sep 17 00:00:00 2001
From: Tim Windelschmidt <tim@monogon.tech>
Date: Sat, 9 Sep 2023 14:22:59 +0200
Subject: [PATCH] reserve metropolis system ports

---
 .../core/service/portallocator/controller/repair.go  | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pkg/registry/core/service/portallocator/controller/repair.go b/pkg/registry/core/service/portallocator/controller/repair.go
index 0ec22c55a54..f890b9c133e 100644
--- a/pkg/registry/core/service/portallocator/controller/repair.go
+++ b/pkg/registry/core/service/portallocator/controller/repair.go
@@ -22,6 +22,8 @@ import (
 	"sync"
 	"time"
 
+	"source.monogon.dev/metropolis/node"
+
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
@@ -148,6 +150,16 @@ func (c *Repair) doRunOnce() error {
 	if err != nil {
 		return fmt.Errorf("unable to create port allocator: %v", err)
 	}
+
+	// pretend that metropolis system ports are in use by an actual service
+	for _, p := range node.SystemPorts {
+		if err := rebuilt.Allocate(int(p)); err != nil {
+			return fmt.Errorf("unable to allocate metropolis port: %v", err)
+		}
+		// remove it from the old set, so it doesn't appear leaked
+		stored.Release(int(p))
+	}
+
 	// Check every Service's ports, and rebuild the state as we think it should be.
 	for i := range list.Items {
 		svc := &list.Items[i]
-- 
2.47.1