Skip to content

daemon: Fix session affinity map creation#12134

Merged
borkmann merged 3 commits intomasterfrom
pr/brb/fix-kube-proxy-init
Jun 18, 2020
Merged

daemon: Fix session affinity map creation#12134
borkmann merged 3 commits intomasterfrom
pr/brb/fix-kube-proxy-init

Conversation

@brb
Copy link
Copy Markdown
Member

@brb brb commented Jun 17, 2020

This PR fixes the BPF session affinity -related maps creation, improves logging of auto detection and moves the replacement helpers into cmd/kube_proxy_replacement.go.

Reviewable per commit.

Fixes: bcdcf9b ("daemon: Move kubeProxyReplacement init after connect to k8s")
Reported-by: Jarno Rajahalme jarno@covalent.io

Fix #12118.

@brb brb added pending-review area/daemon Impacts operation of the Cilium daemon. release-note/bug This PR fixes an issue in a previous release of Cilium. labels Jun 17, 2020
@brb brb requested a review from a team June 17, 2020 10:26
@brb
Copy link
Copy Markdown
Member Author

brb commented Jun 17, 2020

test-me-please

@coveralls
Copy link
Copy Markdown

coveralls commented Jun 17, 2020 •
edited
Loading

Coverage Status

Coverage decreased (-0.02%) to 37.109% when pulling 34c4247 on pr/brb/fix-kube-proxy-init into 0ee0458 on master.

@brb
Copy link
Copy Markdown
Member Author

brb commented Jun 17, 2020

retest-4.19

joestringer
joestringer approved these changes Jun 17, 2020
View reviewed changes
Copy link
Copy Markdown
Member

@joestringer joestringer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor nit. Is the CI failure a flake or potentially caused by this PR?

Comment thread daemon/cmd/daemon_main.go Outdated
@joestringer
Copy link
Copy Markdown
Member

joestringer commented Jun 17, 2020

K8sDatapathConfig Etcd Check connectivity failure:

https://jenkins.cilium.io/job/Cilium-PR-Ginkgo-Tests-Kernel/2162/testReport/junit/Suite-k8s-1/17/K8sDatapathConfig_Etcd_Check_connectivity/

@borkmann
Copy link
Copy Markdown
Member

borkmann commented Jun 17, 2020

K8sDatapathConfig Etcd Check connectivity failure:

https://jenkins.cilium.io/job/Cilium-PR-Ginkgo-Tests-Kernel/2162/testReport/junit/Suite-k8s-1/17/K8sDatapathConfig_Etcd_Check_connectivity/

Known CI flake on 4.19; I think not tracked yet though.

@joestringer
Copy link
Copy Markdown
Member

joestringer commented Jun 17, 2020

retest-4.19

@brb
Copy link
Copy Markdown
Member Author

brb commented Jun 18, 2020

4.19 hit the same Etcd flake.

@brb
Copy link
Copy Markdown
Member Author

brb commented Jun 18, 2020

test-me-please

@brb brb force-pushed the pr/brb/fix-kube-proxy-init branch from e0111ae to 34c4247 Compare June 18, 2020 08:06
@brb
Copy link
Copy Markdown
Member Author

brb commented Jun 18, 2020

Hit Suite-k8s-1.11.K8sPolicyTest Multi-node policy test validates fromEntities policies with remote-node identity enabled Validates fromEntities remote-node policy (https://jenkins.cilium.io/job/Cilium-PR-K8s-oldest-net-next/869/testReport/junit/Suite-k8s-1/11/K8sPolicyTest_Multi_node_policy_test_validates_fromEntities_policies_with_remote_node_identity_enabled_Validates_fromEntities_remote_node_policy/)

@brb
Copy link
Copy Markdown
Member Author

brb commented Jun 18, 2020

retest-net-next

@brb brb force-pushed the pr/brb/fix-kube-proxy-init branch from 34c4247 to 4561293 Compare June 18, 2020 13:26
@brb
Copy link
Copy Markdown
Member Author

brb commented Jun 18, 2020

test-me-please

brb added 3 commits June 18, 2020 15:27
@brb
daemon: Improve initKubeProxyReplacementOptions log messages
a04251a 
- Add session affinity to auto-{enable,disable} msgs.
- Make more clear that auto-enabling does not guarantee that the listed
  features will be enabled.

Signed-off-by: Martynas Pumputis <m@lambda.lt>
@brb
daemon: Create kube-proxy replacement module for helpers
15c19ed 
And move all related helpers from cmd/daemon_main.go into
cmd/kube_proxy_replacement.go to not bloat over the former.

Signed-off-by: Martynas Pumputis <m@lambda.lt>
@brb
daemon: Fix session affinity maps creation
4561293 
Previously, initKubeProxyReplacementOptions() was called after
initMaps() which when running with --kube-proxy-replacement=probe and
--enable-session-affinity=false resulted in the session affinity -related
BPF maps not being created.

An example error log message which illustrated that:

    level=warning msg="Unable to add entry to
    affinity match map" backendID=5 error="Unable to get object
    /sys/fs/bpf/tc/globals/cilium_lb_affinity_match: no such file or
    directory" serviceID=11 subsys=service

Fixes: bcdcf9b ("daemon: Move kubeProxyReplacement init after connect to k8s")
Reported-by: Jarno Rajahalme <jarno@covalent.io>
Signed-off-by: Martynas Pumputis <m@lambda.lt>
@borkmann borkmann merged commit e601e8f into master Jun 18, 2020
@borkmann borkmann deleted the pr/brb/fix-kube-proxy-init branch June 18, 2020 15:50
@jrajahalme jrajahalme mentioned this pull request Jun 18, 2020
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tklauser tklauser tklauser approved these changes

@joestringer joestringer joestringer approved these changes

@aanm aanm aanm approved these changes

Assignees

No one assigned

Labels

area/daemon Impacts operation of the Cilium daemon. release-note/bug This PR fixes an issue in a previous release of Cilium.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

CI: controller bpf-map-sync-cilium_lb_affinity_match is failing

6 participants

@brb @coveralls @joestringer @borkmann @tklauser @aanm