Update iptables perf / KEP-3453 discussion for 1.27 #39188
Conversation
k8s-ci-robot
added
cncf-cla: yes
✅ Pull request preview available for checkingBuilt without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify site settings. |
|
/hold This PR needs to target dev-1.27 (it's OK to wait until dev-1.27 incorporates everything that's in main today). OK to unhold once we fix the base branch. |
k8s-ci-robot
added
the
do-not-merge/hold
|
/sig network |
k8s-ci-robot
added
the
sig/network
There was a problem hiding this comment.
Thanks
For beta, please also revise the text that talks about Endpoints - refer to EndpointSlices if you can. I'm assuming that kube-proxy actually watches EndpointSlices these days (if not, we ought to document that detail somewhere else, and can file an issue to track that).
| If you were previously overriding `minSyncPeriod`, you should try | ||
| removing that override and letting kube-proxy use the default value | ||
| (`1s`) or at least a smaller value than you were using before. | ||
|
|
||
| If you notice kube-proxy's | ||
| `sync_proxy_rules_iptables_restore_failures_total` or | ||
| `sync_proxy_rules_iptables_partial_restore_failures_total` metrics | ||
| increasing after upgrading to 1.27, that likely indicates you are | ||
| encountering bugs in the new code, and you should file a bug report. | ||
| (You can disable the new optimizations by disabling the | ||
| `MinimizeIPTablesRestore` [feature | ||
| gate](/docs/reference/command-line-tools-reference/feature-gates/) for | ||
| kube-proxy with `--feature-gates=MinimizeIPTablesRestore=false,…`.) |
There was a problem hiding this comment.
We avoid documenting transitions between versions within the reference docs (exception: https://kubernetes.io/docs/reference/using-api/deprecation-guide/ and friends). As docs and features move towards GA, this approach becomes more important.
As a result, this information probably belongs in the post-release blog article and in the v1.27 release notes.
The PR that adds the blog article can also update this page to link there, and we can merge that on release day provided that folks plan ahead and get everything ready for review in plenty of time.
There was a problem hiding this comment.
ok, it's already in the release note for kubernetes/kubernetes#115138
There was a problem hiding this comment.
The next step is to cut out or reword this section - otherwise, you'll need to commit SIG Network to maintaining this and updating it for the v1.28 release, when this wording will be stale.
| In Kubernetes 1.27, new performance improvements to the iptables proxy | ||
| mode are enabled by default, which should make it much less necessary to | ||
| override the default syncing timeouts. |
There was a problem hiding this comment.
Try to describe the current state of Kubernetes, post-release. Eg:
By default, the `kube-proxy` component of Kubernetes {{< skew currentVersion >}}
aggregates its updates to `iptables` rules.
Previous versions of Kubernetes (before v1.27) did not default to this behavior, and
FIXME - what does this mean for a cluster operator?
Changed one "Endpoints" to "EndpointSlices" and another to "endpoints"; we still use lowercase-e "endpoints" in many places to refer to endpoints as a general idea |
danwinship
force-pushed
the
kep-3453-beta
branch
from
97f391b
to
ee5f07d
Compare
k8s-ci-robot
added
the
needs-rebase
danwinship
force-pushed
the
kep-3453-beta
branch
from
14263a3
to
236d3dc
Compare
k8s-ci-robot
removed
the
needs-rebase
|
/hold cancel |
k8s-ci-robot
removed
the
do-not-merge/hold
|
/lgtm |
k8s-ci-robot
added
the
lgtm
|
LGTM label has been added. Git tree hash: a98f36df84ff9151f057b7a4057615214788712a
|
k8s-ci-robot
removed
the
lgtm
danwinship
force-pushed
the
kep-3453-beta
branch
from
f94e45d
to
2f7120c
Compare
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: tengqm The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
Co-authored-by: Tim Bannister <tim@scalefactory.com>
danwinship
force-pushed
the
kep-3453-beta
branch
from
2f7120c
to
5170f4a
Compare
|
/lgtm |
k8s-ci-robot
added
the
lgtm
|
LGTM label has been added. Git tree hash: 0aecedf4a7beb71a26ebdc72f92202d5ffbf9570
|
This is an update for a feature going to beta, so I assume it belongs on
dev-1.27, but that branch doesn't seem to be up-to-date? In particular, it doesn't have #38435, which this rewrites.(I moved the feature-specific section because it seemed to make more sense to talk about that first now, since it's enabled by default.)
/cc @sftim @aojea