CI: session affinity failing with kube-proxy-replacement=disabled

[aanm]

Kubernetes conformance tests (test/kubernetes-test.sh + jenkinsfiles/kubernetes-upstream.Jenkinsfile) are currently failing when being run with kube-proxy-replacement=disabled:

17:09:03  Summarizing 3 Failures:
17:09:03  
17:09:03  [Fail] [sig-network] Services [It] should be able to switch session affinity for service with type clusterIP [LinuxOnly] [Conformance] 
17:09:03  /home/vagrant/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/test/e2e/network/service.go:206
17:09:03  
17:09:03  [Fail] [sig-network] Services [It] should have session affinity timeout work for service with type clusterIP [LinuxOnly] [Conformance] 
17:09:03  /home/vagrant/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/test/e2e/network/service.go:206
17:09:03  
17:09:03  [Fail] [sig-network] Services [It] should have session affinity work for service with type clusterIP [LinuxOnly] [Conformance] 
17:09:03  /home/vagrant/go/src/k8s.io/kubernetes/_output/local/go/src/k8s.io/kubernetes/test/e2e/network/service.go:206

Tested with v1.10 branch and v1.9.1 and v1.9.6 tags in 5.12 kernel. Our CI is running k8s e2e tests in 4.19 kernel.

Marking as high priority since we switched our default to kube-proxy-replacement=disabled in #15422

More information about the test failure: https://jenkins.cilium.io/job/Cilium-PR-K8s-Upstream/3089/execution/node/73/log/

The tests will start to pass again once #16162 is merged.

[brb]

@aanm Could you rerun the test with --enable-session-affinity=true? #13480 intended to make it enabled by default.

[aanm]

@brb with --debug --pprof --enable-hubble --hubble-listen-address :4244 --enable-k8s-event-handover --k8s-require-ipv4-pod-cidr --enable-bandwidth-manager --kube-proxy-replacement disabled --enable-remote-node-identity --enable-ipv6-ndp --ipv6-mcast-device enp0s8 -t vxlan --k8s-kubeconfig-path /var/lib/cilium/cilium.kubeconfig --identity-allocation-mode=crd --enable-k8s-event-handover=false --enable-session-affinity=true it also fails.

Is enable-session-affinity enabled even if kube-proxy-replacement is disabled?

[brb]

Is enable-session-affinity enabled even if kube-proxy-replacement is disabled?

No, see the PR linked above.

[borkmann]

Is enable-session-affinity enabled even if kube-proxy-replacement is disabled?

No, see the PR linked above.

You would have to default to partial with enable-session-affinity instead. Then it will work.

[brb]

#16179 should have fixed the issue.