cilium-cli: enable websockets for k8s exec #37538
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bb772d4 to
e2a5972
Compare
|
/test |
|
As an aside, this will also reduce the likelihood of #31067 by quite a bit 🫶 |
bimmlerd
reviewed
Feb 12, 2025
e2a5972 to
db0e00e
Compare
Users of Cilium have begun to report that the `cilium sysdump` command
encounters errors with the following form:
error with exec request ... : Upgrade request required: ""
Kubernetes v1.31 made Websocket the default streaming protocol for use
by kubectl[1]. As described in KEP-4006[2], the prior protocol in use,
SPDY, has been deprecated since 2015, and is no longer supported by many
proxies, gateways and loadbalancers. Such proxies will result in clients
observing errors like the above in cases where SPDY is not supported.
This PR changes the streaming protocol used by the Cilium CLI for
commands such as `cilium sysdump`, to use the new Websocket executor
supported by client-go.
It makes use of the fallback mechanism provided by the apimachinery
package, to fallback to SPDY in the case that common protocol errors are
observed.
[1]: https://kubernetes.io/blog/2024/08/20/websockets-transition/
[2]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/4006-transition-spdy-to-websockets
Signed-off-by: Andrew Sauber <andrew.sauber@isovalent.com>
db0e00e to
2b00ca4
Compare
Users of Cilium have reported that the `cilium sysdump` command
encounters errors with the following form:
failed to collect ...: Upgrade request required
As part of KEP-4006, a protocol translator proxy was implemented to
allow websocket-based connections to the kube-apiserver by kubectl to be
translated to SPDY-based connections to the kubelet by the
kube-apiserver, for the sake of features like kubectl port-forward.
In the case of either protocol for the backend-leg connection, we prefer
to use the websocket-based client connection to avoid errors like the
above.
This PR uses a fallback mechanism which was implemented in the
apimachinery package to support implementations in upgrading to
websocket clients, which was made default in Kubernetes 1.31.
[1]: https://github.com/kubernetes/enhancements/tree/master/keps/sig-api-machinery/4006-transition-spdy-to-websockets
[2]: kubernetes/kubernetes#119186
Signed-off-by: Andrew Sauber <andrew.sauber@isovalent.com>
2b00ca4 to
88089dd
Compare
|
/test |
bimmlerd
approved these changes
Feb 18, 2025
|
This is hitting #37682 |
gandro
approved these changes
Feb 18, 2025
|
@julianwiedmann Yes, I traced the upstream websocket implementation, which has a hardcoded timeout after seeing no writes for 60 seconds. Since we switched to tcpdump writing to a file rather than stdout, the |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Users of Cilium have begun to report that the
cilium sysdumpcommand encounters errors with the following form:Kubernetes v1.31 made Websocket the default streaming protocol for use by kubectl1. As described in KEP-40062, the prior protocol in use, SPDY, has been deprecated since 2015, and is no longer supported by many proxies, gateways and loadbalancers. Such proxies will result in clients observing errors like the above in cases where SPDY is not supported.
This PR changes the streaming protocol used by the Cilium CLI for commands such as
cilium sysdump, to use the new Websocket executor supported by client-go.It makes use of the fallback mechanism provided by the apimachinery package, to fallback to SPDY in the case that common protocol errors are observed.