[v1.8] Delete Cilium Endpoints for no longer running Pods #13592
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
aanm
added
kind/bug
maintainer-s-little-helper
bot
added
the
kind/backports
|
test-backport-1.8 |
christarazi
approved these changes
Oct 15, 2020
|
retest-net-next |
[ upstream commit 2988760 ] This field is essential to understand if the pod is still running or not. Signed-off-by: André Martins <andre@cilium.io>
[ upstream commit b3adc4d ] In Kubernetes, a Job creates a pod which will complete with either the "Succeeded" or "Failed" PodPhase. Kubernetes will leave these Pods around until the Job is deleted by the operator. As soon the pod enters either one of the previously described PodPhases, Kubelet will send a CNI delete event to Cilium agent which will then release the allocated IP addresses of that pod, making the IP address available again. If not disabled, Cilium will create a Cilium Endpoint for each Pod in the cluster that has its network managed by Cilium. Cilium agent populates the ipcache with the information retrieved from Pods and Cilium Endpoints events, in case of duplicated information, ipcache will be stored with the state from Cilium Endpoints. In a unlikely case of Cilium agent not running and the Pod enters the "Succeeded" state, it will mean the Cilium agent will not be available to delete the Cilium Endpoint created for that Pod. To complement this fix, Cilium agents will also prune Cilium Endpoints of not running pods on start up. Signed-off-by: André Martins <andre@cilium.io>
aanm
force-pushed
the
pr/backport-13220
branch
from
d88f309
to
65eeb0c
Compare
|
test-backport-1.8 |
|
test-missed-k8s |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Since the backport #13263 was not enough, we need to backport a couple more commits from the original PR #13220
These commits are also required since a leftover Pod might no longer have a local cilium endpoint available. This means, on restore, the leftover Cilium endpoint will never be removed by the Cilium agent. Thus, the job of garbage collecting these Cilium Endpoints needs to be done by the Cilium Operator.
Fixes #13240