a bug may exist in the processNextItem function in ipsec_controller.go.

[zrggw]

What happened:
When the IPsec controller executes processNextItem, it always calls Forget(key) and Done(key). Therefore, the error handling in processNextItem for handleOneNodeInfo(ipsec_controller.go line 436) becomes meaningless because NumRequeues always returns 0.

What you expected to happen:
It may be possible to insert return true for error handling of handleOneNodeInfo.
Here is the code may has bug:

func (c *IPSecController) processNextItem() bool {
	key, quit := c.queue.Get()
	if quit {
		return false
	}
	defer c.queue.Done(key)

	name, ok := key.(string)
	if !ok {
		log.Errorf("expected QueueItem but got %T", key)
		return true
	}

	node, err := c.lister.KmeshNodeInfos(kube.KmeshNamespace).Get(name)
	if err != nil {
		if !apierrors.IsNotFound(err) {
			log.Errorf("failed to get kmesh node info %s: %v", name, err)
		}
		return true
	}
	if err := c.handleOneNodeInfo(node); err != nil {
		if c.queue.NumRequeues(key) < MaxRetries {
			log.Errorf("failed to handle other node %s err: %v, will retry", name, err)
			c.queue.AddRateLimited(key)
		} else {
			log.Errorf("failed to handle other node %s err: %v, giving up", name, err)
			c.queue.Forget(key)
		}
	}

	c.queue.Forget(key)
	return true
}

Here is the new code may fixes the bug.

	if err := c.handleOneNodeInfo(node); err != nil {
  		if c.queue.NumRequeues(key) < MaxRetries {
  			log.Errorf("failed to handle other node %s err: %v, will retry", name, err)
  			c.queue.AddRateLimited(key)
  		} else {
  			log.Errorf("failed to handle other node %s err: %v, giving up", name, err)
  			c.queue.Forget(key)
  		}
		return true
  	}

How to reproduce it (as minimally and precisely as possible):

Anything else we need to know?:

Environment:

• Kmesh version:
• Kmesh mode: Kernel-Native Mode and Duel-Engine Mode
• Istio version: 1.26.2
• Kernel version:6.8.0-49-generic
• Others:

[zrggw]

/assign

[zrggw]

I'm trying to fix this issue in PR #1461