[v1.8] k8s: delete CEPs for no running Pods #13263
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
7a193df to
70934d3
Compare
joestringer
approved these changes
Sep 25, 2020
| } | ||
| if err := ciliumClient.CiliumEndpoints(namespace).Delete(ctx, podName, meta_v1.DeleteOptions{}); err != nil { | ||
| if !k8serrors.IsNotFound(err) { | ||
| scopedLog.WithError(err).Warning("Unable to delete CEP") |
There was a problem hiding this comment.
I guess this is best effort, ie if there's another error like lack of permissions then we will just give up rather than returning an error to the controller to ensure it gets retried?
There was a problem hiding this comment.
The issue is that it doesn't look like the controller retires on stop functions. 😢 In any case, the operator will perform the GC of CEPs.
[ upstream commit b3adc4d ] If an endpoint is not able to be restored we should delete the Cilium Endpoint from Kubernetes to avoid having dangling Cilium Endpoints in Kubernetes. Signed-off-by: André Martins <andre@cilium.io>
…ted" [ upstream commit 0fbd2b4 ] This reverts commit 8068f1a. This reverted commit introduces a regression where Cilium Endpoints can be left around after the Cilium Endpoint was locally deleted. Although it was a scale optimization for non existing docker images, the security aspect will overlap the scalability concern initially thought. Signed-off-by: André Martins <andre@cilium.io>
[ upstream commit f1b61a7 ] To avoid wasting resources in Cilium and to avoid leftover CiliumEndpoints from populating the ipcache, we should not watch for CiliumEndpoints when disable-endpoint-crd is set to true. Signed-off-by: André Martins <andre@cilium.io>
Doing a return regardless of the error condition would prevent Cilium Endpoints to be GCed in a single run. Fixes: 37139c3 ("operator: remove pod list of an entire cluster") Signed-off-by: André Martins <andre@cilium.io>
70934d3 to
8e85f87
Compare
|
test-backport-1.8 |
christarazi
approved these changes
Sep 25, 2020
qmonnet
approved these changes
Sep 26, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Partial backport of #13220