k8s: delete IPs from ipcache for no running Pods #13220
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
aanm
added
kind/bug
maintainer-s-little-helper
bot
added
the
dont-merge/needs-release-note-label
aanm
added
the
release-note/bug
maintainer-s-little-helper
bot
removed
the
dont-merge/needs-release-note-label
|
test-me-please |
nathanjsweet
approved these changes
Sep 18, 2020
christarazi
requested changes
Sep 18, 2020
aanm
force-pushed
the
pr/fix-complete-pod-statuses
branch
from
ed7b66a
to
3ad73f7
Compare
|
test-me-please |
|
retest-gke |
pchaigno
approved these changes
Sep 21, 2020
christarazi
reviewed
Sep 21, 2020
aanm
changed the title
aanm
force-pushed
the
pr/fix-complete-pod-statuses
branch
from
3ad73f7
to
6b22034
Compare
aanm
removed
the
sig/k8s
|
test-me-please |
aanm
force-pushed
the
pr/fix-complete-pod-statuses
branch
from
6b22034
to
414bb72
Compare
|
test-me-please |
tklauser
approved these changes
Sep 23, 2020
joestringer
reviewed
Sep 25, 2020
joestringer
approved these changes
Sep 25, 2020
…ted" This reverts commit 8068f1a. This reverted commit introduces a regression where Cilium Endpoints can be left around after the Cilium Endpoint was locally deleted. Although it was a scale optimization for non existing docker images, the security aspect will overlap the scalability concern initially thought. Signed-off-by: André Martins <andre@cilium.io>
To avoid wasting resources in Cilium and to avoid leftover CiliumEndpoints from populating the ipcache, we should not watch for CiliumEndpoints when disable-endpoint-crd is set to true. Signed-off-by: André Martins <andre@cilium.io>
This field is essential to understand if the pod is still running or not. Signed-off-by: André Martins <andre@cilium.io>
In Kubernetes, a Job creates a pod which will complete with either the "Succeeded" or "Failed" PodPhase. Kubernetes will leave these Pods around until the Job is deleted by the operator. As soon the pod enters either one of the previously described PodPhases, Kubelet will send a CNI delete event to Cilium agent which will then release the allocated IP addresses of that pod, making the IP address available again. If not disabled, Cilium will create a Cilium Endpoint for each Pod in the cluster that has its network managed by Cilium. Cilium agent populates the ipcache with the information retrieved from Pods and Cilium Endpoints events, in case of duplicated information, ipcache will be stored with the state from Cilium Endpoints. In a unlikely case of Cilium agent not running and the Pod enters the "Succeeded" state, it will mean the Cilium agent will not be available to delete the Cilium Endpoint created for that Pod. To complement this fix, Cilium agents will also prune Cilium Endpoints of not running pods on start up. Signed-off-by: André Martins <andre@cilium.io>
aanm
force-pushed
the
pr/fix-complete-pod-statuses
branch
from
414bb72
to
6a160dd
Compare
|
test-me-please |
|
hit #13224 |
maintainer-s-little-helper
bot
moved this from Needs backport from master
to Backport pending to v1.8
in 1.8.4
maintainer-s-little-helper
bot
moved this from Backport pending to v1.8
to Backport done to v1.8
in 1.8.4
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In Kubernetes, a Job creates a pod which will complete with either
the "Succeeded" or "Failed" PodPhase. Kubernetes will leave these
Pods around until the Job is deleted by the operator. As soon the pod
enters either one of the previously described PodPhases, Kubelet will
send a CNI delete event to Cilium agent which will then release the
allocated IP addresses of that pod, making the IP address available
again.
If not disabled, Cilium will create a Cilium Endpoint for each Pod in
the cluster that has its network managed by Cilium.
Cilium agent populates the ipcache with the information retrieved from
Pods and Cilium Endpoints events, in case of duplicated information,
ipcache will be stored with the state from Cilium Endpoints.
In a unlikely case of Cilium agent not running and the Pod enters the
"Succeeded" state, it will mean the Cilium agent will not be available
to delete the Cilium Endpoint created for that Pod.
To complement this fix, Cilium agents will also prune Cilium Endpoints
of not running pods on start up.
Fixes #12953