operator: remove pod list of an entire cluster #11376
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Please set the appropriate release note label. |
aanm
added
the
release-note/bug
aanm
force-pushed
the
pr/avoid-pod-list
branch
2 times, most recently
from
1eee453
to
3371814
Compare
aanm
changed the base branch from
pr/use-slimmer-protobuf-definitions-others
to
master
aanm
added
area/operator
|
test-me-please |
nebril
approved these changes
May 8, 2020
|
test-me-please |
operator/k8s_cep_gc.go
Outdated
| // there is more data, continue | ||
| continue perCEPFetch | ||
| if !exists { | ||
| // FIXME: this is fragile has we might have received the |
There was a problem hiding this comment.
there are a few typos in this comment...
|
test-me-please |
This was referenced May 11, 2020
vadorovsky
approved these changes
May 11, 2020
|
test-me-please |
|
retest-net-next |
aanm
force-pushed
the
pr/avoid-pod-list
branch
2 times, most recently
from
ad9813c
to
842782d
Compare
|
test-me-please |
tgraf
requested changes
May 13, 2020
operator/identity/heartbeat.go
Outdated
| @@ -57,6 +58,11 @@ func (i *IdentityHeartbeatStore) IsAlive(identity string) bool { | |||
| i.mutex.RLock() | |||
| defer i.mutex.RUnlock() | |||
|
|
|||
| // The identity is definitely alive if there's a CE using it. | |||
| if watchers.HasCEWithIdentity(identity) { | |||
There was a problem hiding this comment.
This looked very expensive at first but the index makes it bearable it seems.
|
test-me-please |
aanm
force-pushed
the
pr/avoid-pod-list
branch
2 times, most recently
from
5f1e79b
to
199c64c
Compare
|
test-me-please |
Doing a pod list every 30 minutes can be brutal for kube-apiserver, specially if it is not running with a limit of the number of pods that should be returned. Having a watcher that receives notifications for the pods running as well as the CEPs, is enough to provide a GC for Cilium Identities and CEPs. Since we have a k8s watcher and the CEPs have an owner set to themselves the CEP GC interval was decreased to 5 minutes. Also, given that we don't depend on the CEP GC to perform Cilium Identity GC we can set the identity heartbeat timeout to 2* the KVStore Lease TTL. Signed-off-by: André Martins <andre@cilium.io>
|
test-me-please |
tgraf
approved these changes
May 13, 2020
|
hit #11512 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Doing a pod list every 30 minutes can be brutal for kube-apiserver, specially if it is not running with a limit of the number of pods that should be returned. Having a watcher that receives notifications for the pods running as well as the CEPs, is enough to provide a GC for Cilium Identities and CEPs.
Since we have a k8s watcher and the CEPs have an owner set to themselves the CEP GC interval was decreased to 5 minutes.
Also, given that we don't depend on the CEP GC to perform Cilium IdentityGC we can set the identity heartbeat timeout to 2* the KVStore Lease TTL.
Signed-off-by: André Martins andre@cilium.io
Fixes #11472