Unnecessary watch of headless-related EndpointSlice objects

[tosi3k]

Is there an existing issue for this?

• I have searched the existing issues

What happened?

When debugging a heavily loaded cluster with a high churn on pods fronted by the headless services, we found out that cilium-agents watch all EndpointSlice objects rather than the ones that correspond to usual services only, contrary to what kube-proxy does.

In addition, cilium-agent already filters out headless services in its label selector on services watch, so I believe this to be a bug, unless I'm not aware of some special use case the agent has for this 🤷.

Cilium Version

1.12.10

Kernel Version

N/A

Kubernetes Version

1.27.2

Sysdump

No response

Relevant log output

kube-proxy watches initialization logged in kube-apiserver:
`"Starting watch" path="/apis/discovery.k8s.io/v1/endpointslices" resourceVersion="9752340" labels="!service.kubernetes.io/headless,!service.kubernetes.io/service-proxy-name" fields="" timeout="9m29s"`
`"Starting watch" path="/api/v1/services" resourceVersion="9753278" labels="!service.kubernetes.io/headless,!service.kubernetes.io/service-proxy-name" fields="" timeout="7m5s"`

cilium-agent watches initialization logged in kube-apiserver:
`"Starting watch" path="/apis/discovery.k8s.io/v1/endpointslices" resourceVersion="15437961" labels="" fields="" timeout="8m43s"`
`"Starting watch" path="/api/v1/services" resourceVersion="15438967" labels="!service.kubernetes.io/headless,!service.kubernetes.io/service-proxy-name" fields="" timeout="7m5s"`

Anything else?

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[tosi3k]

I think that a PR that was merged 4 days ago fixes this on the occasion (

cilium/pkg/k8s/resource_ctors.go

Lines 154 to 158 in d0ab559

	func EndpointsResource(lc hive.Lifecycle, cs client.Clientset) (resource.Resource[*Endpoints], error) {
	if !cs.IsEnabled() {
	return nil, nil
	}
	optsModifier, err := utils.GetServiceListOptionsModifier(option.Config)

), though.