What would you like to be added?

We'd like to have conntrack reconciler for Services in kube-proxy, for each Service or Endpoint change it should reconcile the Service/Endpoint table with the existing conntrack table and remove stale UDP entries (we have concluded in other issues that UDP is the only protocol that requires this)

Why is this needed?

Despite a lot of work and testing was added to solve the problem with stale UDP entries that can blackhole traffic, we still have reports of issues related to UDP stale entries

#125467

Also, the conntrack logic is event based and, as expected, if something fails it never reconciles

#112604

The reconciler will only delete the entries that are known to be stale, other entries will time out.

References

Some WIP I had https://github.com/kubernetes/kubernetes/compare/master...aojea:kubernetes:conntrack_done_right?expand=1

Related issues that will be fixed

• Dropped UDP packets on pod restart #125979
• Conntrack tables having stale entries for UDP connection #125467
• UDP connections of Services are not preserved after restarting kube-proxy #122740