The FQDN proxy can get into a state where forwarding no longer occurs. Comparing a cilium-sysdump before and after reveals:
- No difference in any datapath plumbing
- Equivalent gops-stack for FQDN code, both are blocking on IO wait
However, the reported proxy statistics are very different. While this problem is occurring:
"proxy-statistics": [
{
"allocated-proxy-port": 18064,
"location": "egress",
"port": 8053,
"protocol": "dns",
"statistics": {
"requests": {},
"responses": {}
}
},
{
"allocated-proxy-port": 18064,
"location": "egress",
"port": 8053,
"protocol": "dns",
"statistics": {
"requests": {},
"responses": {}
}
}
],After restarting cilium-agent to resolve the issue:
"proxy-statistics": [
{
"allocated-proxy-port": 32463,
"location": "egress",
"port": 8053,
"protocol": "dns",
"statistics": {
"requests": {
"denied": 146,
"forwarded": 40,
"received": 186
},
"responses": {
"forwarded": 40,
"received": 40
}
}
},
{
"allocated-proxy-port": 32463,
"location": "egress",
"port": 8053,
"protocol": "dns",
"statistics": {
"requests": {},
"responses": {}
}
}
],
The FQDN proxy can get into a state where forwarding no longer occurs. Comparing a
cilium-sysdumpbefore and after reveals:However, the reported proxy statistics are very different. While this problem is occurring:
After restarting
cilium-agentto resolve the issue: