fix(driver-k8s): add label selector to sandbox watch stream and list#2223
Open
rhuss wants to merge 1 commit into
Open
fix(driver-k8s): add label selector to sandbox watch stream and list#2223rhuss wants to merge 1 commit into
rhuss wants to merge 1 commit into
Conversation
…VIDIA#2211) The Kubernetes driver's watch_sandboxes() crashed with a file descriptor leak when non-gateway Sandbox resources (e.g. from SandboxWarmPool) existed in the namespace. The unfiltered watch received events for all Sandbox objects, failed to extract IDs from warm pool objects, and propagated errors that triggered a 2-second reconnect loop leaking HTTP/2 connections until FD exhaustion. Two fixes: - Add openshell.ai/managed-by=openshell label selector to the watcher config and list params so only gateway-managed objects are received. - Defensively skip unrecognized objects with a debug log instead of sending errors to the channel, using let-else for flat control flow. Signed-off-by: Roland Huß <roland@jolokia.org> Signed-off-by: Roland Huß <rhuss@redhat.com>
rhuss
requested review from
a team,
derekwaynecarr,
maxamillion and
mrunalp
as code owners
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The K8s driver's
watch_sandboxes()crashes with a file descriptor leak when non-gatewaySandboxresources (e.g. fromSandboxWarmPool) exist in the namespace. This adds a label selector to filter at the API server level, and defensively skips unrecognized objects instead of propagating errors to the channel.Related Issue
Fixes #2211
Changes
openshell.ai/managed-by=openshelllabel selector to thewatcher::Configinwatch_sandboxes()so only gateway-managed Sandbox objects generate watch eventsListParamsinlist_sandboxes()so only gateway-managed objects are returnedlet ... elseguards thatdebug!log the object name andcontinue, preventing crash loops from unrecognized objectssandbox_id_from_objectandsandbox_from_objectcovering label extraction, name-prefix fallback, unknown object rejection, and the managed-by-without-sandbox-id edge caseTesting
cargo clippy -p openshell-driver-kubernetes --all-targets -- -D warnings: Cleancargo test -p openshell-driver-kubernetes: 129 passed (123 existing + 6 new)Checklist