daemon: Add option conntrackGCMaxInterval #27870
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
joamaki
added
the
release-note/misc
joamaki
force-pushed
the
pr/joamaki/conntrack-gc-interval-max
branch
2 times, most recently
from
a267177
to
731e9f8
Compare
joamaki
force-pushed
the
pr/joamaki/conntrack-gc-interval-max
branch
from
731e9f8
to
7af1eed
Compare
joamaki
commented
Sep 4, 2023
joamaki
force-pushed
the
pr/joamaki/conntrack-gc-interval-max
branch
2 times, most recently
from
e0d81f1
to
045ccb9
Compare
|
/test |
joamaki
added
needs-backport/1.12
needs-backport/1.13
ldelossa
requested changes
Sep 5, 2023
learnitall
requested changes
Sep 5, 2023
There was a problem hiding this comment.
Small grammar nit, but otherwise LGTM.
One suggestion I do have, which isn't necessary but would be nice, is somehow changing the value for the conntrackGCMaxInterval to the actual default that Cilium will use if it isn't set. Having a default value for 0s is a bit confusing.
tommyp1ckles
approved these changes
Sep 12, 2023
joamaki
commented
Sep 12, 2023
joamaki
force-pushed
the
pr/joamaki/conntrack-gc-interval-max
branch
from
f6efccd
to
a5f95cd
Compare
|
/test |
When ToFQDN policies are in use (CIDR) identities are created for each IP in a DNS response that matches a ToFQDN policy. These identities are garbage collected when 1) all endpoints with ToFQDN policies are removed 2) the maximum number of IPs per host is reached (tofqdn-max-ips-per-host) 3) when the identity has been unused and not refreshed by conntrack map GC Problems arise when he conntrack GC interval becomes very long. If it's backed by a LRU BPF map, the maximum is set to 12 hours (defaults.ConntrackGCMaxLRUInterval), meaning it will take 12 hours before unused identities are marked dead and collected (unless tofqdn-max-ips-per-host limit is reached for the FQDN entry). To allow user to have more control over this add the conntrackGCMaxInterval option that will allow limiting the maximum interval to something less than the 12 hours. Signed-off-by: Jussi Maki <jussi@isovalent.com>
joamaki
force-pushed
the
pr/joamaki/conntrack-gc-interval-max
branch
from
a5f95cd
to
5ad0e56
Compare
|
/test |
maintainer-s-little-helper
bot
added
the
ready-to-merge
doniacld
added
backport-pending/1.13
joamaki
added
backport-done/1.12
giorio94
added
backport-pending/1.14
aanm
added
backport-done/1.14
jrajahalme
moved this from Needs backport from main
to Backport done to v1.13
in 1.13.8
This was referenced Oct 17, 2023
2 tasks
squeed
added a commit
to squeed/cilium
that referenced
this pull request
Feb 23, 2024
The FQDN proxy will GC IP addresses that are both: - past their DNS TTLs, and - no longer in use by active connections However, many applications do not immediately re-resolve names between connections, even if the TTL has expired. This can cause traffic to be dropped unexpectedly. Previously, this was not an issue, as FQDN GC happened very rarely. This has been improved, however, by cilium#27572 and cilium#27870. Now, end-users occasionally being surprised by this. This sets the default grace period to 60 seconds, in an attempt to find a good balance between application needs and security. Signed-off-by: Casey Callendrello <cdc@isovalent.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When ToFQDN policies are in use (CIDR) identities are created for each IP in a DNS response that matches a ToFQDN policy. These identities are garbage collected when
Problems arise when he conntrack GC interval becomes very long. If it's backed by a LRU BPF map, the maximum is set to 12 hours (defaults.ConntrackGCMaxLRUInterval), meaning it will take 12 hours before unused identities are marked dead and collected (unless tofqdn-max-ips-per-host limit is reached for the FQDN entry).
To allow user to have more control over this add the conntrackGCMaxInterval option that will allow limiting the maximum interval to something less than the 12 hours.