Endpoint/CEP Ownership Fix #21768
Merged
Endpoint/CEP Ownership Fix #21768
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Commit 675c00e91ba2c5e7f6c65bc86dc04ba3b643f407 does not contain "Signed-off-by". Please follow instructions provided in https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#developer-s-certificate-of-origin |
|
This pull request has been automatically marked as stale because it |
675c00e to
a40b0b0
Compare
|
/test |
|
/test-1.25-net-next |
17fc9d0 to
dcf9db8
Compare
|
/test |
244455c to
cf4705c
Compare
|
/test |
cf4705c to
5a070c2
Compare
|
/test |
5a070c2 to
8d94b91
Compare
|
/test |
@tommyp1ckles let's do it for 1.13 and 1.12 for now /cc @joestringer |
This is intended to prevent endpoints from overwriting ciliumendpoints that have the same name but are being managed by a new endpoint sync. This can occur because endpointsynchronizer controllers can overlap when restarting a statefulset (i.e. two CEPs will have the same namespace and name as each other). By adding an operation for patching the UID, this ensures that only endpoints with the UID of the current CEP in apiserver will be able to successfully mutate the CEP status. All other requests will be rejected due to the immutability constraint on UID. Fixes: cilium#19931 Signed-off-by: Tom Hadlaw <tom.hadlaw@isovalent.com>
This change adds writing the CiliumEndpoint UID to an endpoints restore. CiliumEndpoint UID is not currently written alongside the stored restore data. This can cause problems related to ambiguous ownership of CEPs by endpoint synchronizers. Signed-off-by: Tom Hadlaw <tom.hadlaw@isovalent.com>
Prevents endpointsynchronizer from taking ownership and managing ciliumendpoints, except in the case of endpoint restore where the ciliumendpoint is on the same node as the agent. This fixes bugs related to two endpointsynchronizers running for pods of the same name (i.e. as can happen in the case of Stateful sets). Fixes: cilium#19931 Signed-off-by: Tom Hadlaw <tom.hadlaw@isovalent.com>
Signed-off-by: Tom Hadlaw <tom.hadlaw@isovalent.com>
3306def to
eabb193
Compare
|
/test |
This was referenced Jan 14, 2023
This was referenced Jan 19, 2023
Merged
This was referenced Jan 24, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes: #19931