fix(controller): take Local targets from the nodes kube-proxy serves - #56

…ng (#49)

* perf(controller): react to node and endpoint changes instead of polling

Every LoadBalancer service was reconciled every 30 seconds, and each run
cost one or two Hetzner API requests even when nothing changed. The
short interval was there because only Services were watched, so a new
node or a moved pod reached the balancer only through that requeue.

Node changes that affect targets now reconcile every service. Heartbeat
updates are ignored, since only labels, cordoning, readiness and
addresses are compared. An endpoint slice change reconciles its service
when it is a robotlb balancer with the Local traffic policy and the
nodes its targets follow changed: all endpoint nodes when targets come
from pods, ready endpoint nodes otherwise. Readiness flaps and address
changes that leave those nodes alone cost nothing. The controller's
watch mapper cannot tell a deletion from an update, so a second watch
tracks which slices exist; a deleted slice with endpoints reconciles
every service. The periodic resync is now ROBOTLB_RESYNC_INTERVAL, five
minutes by default and at most a year.

A reconcile that could not add some targets, for a reason other than
the rate limit, is retried after 30 seconds like a failed one, so a
temporarily rejected node does not wait for the resync.

Pods that have finished or have no IP yet no longer count as targets.
Neither is in the endpoint slice, so deleting them would leave their
node a target until the resync.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>

* fix(controller): take Local targets from the nodes kube-proxy serves (#56)

A Local service with a selector took its targets from the pods the
selector matched. That kept nodes where kube-proxy had no endpoint to
send traffic to, such as the node of a pod that is not ready yet, and
so nodes that fail the balancer's health check. A cordoned or
not-ready node running a matching pod stayed a target too, unlike
under the Cluster policy, with nothing saying whether that was
intended.

Every Local service now takes its targets from its EndpointSlices, the
path already used for services without a selector. A node is a target
when kube-proxy serves Local traffic from it: it has a ready endpoint,
or a terminating endpoint that still serves, which kube-proxy falls
back to while the node has no ready one. Missing conditions are read
the way kube-proxy reads them.

Targets and the slice trigger share this filter, so the trigger no
longer needs a separate pod-based mode. robotlb no longer reads pods
at all, and the chart's default role drops its access to them.

Assisted-by: LLM

Signed-off-by: Aleksei Sviridkin <f@lex.la>

---------

Signed-off-by: Aleksei Sviridkin <f@lex.la>