daemon: Add require-k8s-connectivity flag to enable usage with cloud NLB services #39434
Conversation
|
/test |
There was a problem hiding this comment.
See one comment inline about the naming of the flag.
Also, the command reference would need to be updated using make -C Documentation update-cmdref to contain the new flag. Usually CI should point this out, but it seems this isn't the case right now. Will look into it.
…NLB services Add 'require-k8s-connectivity' flag to Cilium agent (default: true) This flag controls whether agent health checks require Kubernetes connectivity. Previously this was only possible using a custom HTTP header, which doesn't work with cloud Network Load Balancers. Setting this to 'false' allows health checks to succeed when K8s connectivity is unavailable. Signed-off-by: ya-makariy <me@ya-makariy.com>
9b08572 to
0b32d28
Compare
|
/test |
|
cc @tkna what was the original rationale for adding this into the healthz API? This approach seems much simpler overall. |
|
@tklauser it looks like merge checks failed unexpectedly, could you please add this pr back to merge queue? |
The original rationale was:
Ref: #32724 (comment) That said, I think there's no problem with supporting both approaches.
As I understand it, this PR sets the daemon config for the Pod’s /healthz endpoint, but not for the Cilium API’s /healthz endpoint. |
|
@tkna thanks, I think that's fine then 👍 The change here is setting the default value for whether to require k8s connectivity via a command-line flag. If the healthz API call specifies this attribute, it will override the behavior. |
Add 'require-k8s-connectivity' flag to Cilium agent (default: true)
This flag controls whether agent health checks require Kubernetes connectivity. Previously this was only possible using a custom HTTP header, which doesn't work with cloud Network Load Balancers. Setting this to 'false' allows health checks to succeed when K8s connectivity is unavailable.
Related PR: #32724