Skip to content

Remove Resource[Service] and Resource[Endpoints]#42440

Merged
joamaki merged 8 commits intocilium:mainfrom
joamaki:pr/joamaki/remove-agent-endpointslice-services-resources
Dec 4, 2025
Merged

Remove Resource[Service] and Resource[Endpoints]#42440
joamaki merged 8 commits intocilium:mainfrom
joamaki:pr/joamaki/remove-agent-endpointslice-services-resources

Conversation

@joamaki
Copy link
Copy Markdown
Contributor

@joamaki joamaki commented Oct 28, 2025 •
edited
Loading

Switch over remaining uses of Resource[*slim_corev1.Service] and Resource[*k8s.Endpoints] over to Table[*lb.Service] or Table[*lb.Frontend] in the agent. This avoids indexing and holding onto duplicate services and endpoints and thus reduces memory usage.

Results from github.com/joamaki/cilium-lb-load-test which creates 5000 services with 10 backends each and measures memory usage:

main branch (66a4e8e45187f9e25235113690e0ebf6275a81f4)

$ ./run-loadtest.sh
...
RSS (kB): 291900.0 (diff 136920.0)
Reachable kB: 96813.1484375
Allocations: 6006325
Allocated kB: 339197.2578125

This PR

RSS (kB): 281664.0 (diff 124964.0)
Reachable kB: 80810.9140625
Allocations: 5933907
Allocated kB: 324277.0859375

@maintainer-s-little-helper maintainer-s-little-helper bot added the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Oct 28, 2025
@joamaki joamaki force-pushed the pr/joamaki/remove-agent-endpointslice-services-resources branch 2 times, most recently from 0a783a8 to b5575dd Compare October 28, 2025 11:44
@joamaki joamaki added the release-note/misc This PR makes changes that have no direct user impact. label Oct 28, 2025
@maintainer-s-little-helper maintainer-s-little-helper bot removed the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Oct 28, 2025
@joamaki
Copy link
Copy Markdown
Contributor Author

joamaki commented Oct 29, 2025

/test

joamaki
joamaki commented Oct 29, 2025
View reviewed changes
@joamaki joamaki force-pushed the pr/joamaki/remove-agent-endpointslice-services-resources branch from b5575dd to 93d7974 Compare October 30, 2025 15:22
@joamaki
Copy link
Copy Markdown
Contributor Author

joamaki commented Oct 31, 2025

/test

@joamaki joamaki force-pushed the pr/joamaki/remove-agent-endpointslice-services-resources branch from 93d7974 to c51f478 Compare October 31, 2025 12:49
@joamaki joamaki force-pushed the pr/joamaki/remove-agent-endpointslice-services-resources branch from c51f478 to 891a203 Compare November 11, 2025 13:44
@joamaki
Copy link
Copy Markdown
Contributor Author

joamaki commented Nov 12, 2025

/test

@joamaki joamaki force-pushed the pr/joamaki/remove-agent-endpointslice-services-resources branch from 891a203 to 64f6946 Compare November 12, 2025 13:31
@joamaki joamaki force-pushed the pr/joamaki/remove-agent-endpointslice-services-resources branch from 64f6946 to a5e8d20 Compare November 20, 2025 11:46
@joamaki
Copy link
Copy Markdown
Contributor Author

joamaki commented Nov 20, 2025

/test

@joamaki joamaki force-pushed the pr/joamaki/remove-agent-endpointslice-services-resources branch from a5e8d20 to 7939ca0 Compare November 24, 2025 09:59
@joamaki
Copy link
Copy Markdown
Contributor Author

joamaki commented Nov 24, 2025

/test

@joamaki joamaki force-pushed the pr/joamaki/remove-agent-endpointslice-services-resources branch from 7939ca0 to bb543fe Compare November 26, 2025 12:02
@joamaki
Copy link
Copy Markdown
Contributor Author

joamaki commented Nov 26, 2025

/test

@joamaki joamaki marked this pull request as ready for review November 26, 2025 13:51
@joamaki joamaki requested review from a team as code owners November 26, 2025 13:51
@joamaki
loadbalancer/reflectors: Reflect endpoints directly
5d8a866 
Use the [k8s.ListerWatcherToObservable] to reflect endpoints directly
without relying on Resource[Endpoints].

Signed-off-by: Jussi Maki <jussi@isovalent.com>
@joamaki
ipcache: Watch backends table to update api-server labels
eb0a119 
Signed-off-by: Jussi Maki <jussi@isovalent.com>
@joamaki
daemon: Remove Resource[Endpoints] and endpoints watcher
7ce971a 
EndpointsWatcher and Resource[Endpoints] is no longer needed by the cilium-agent
as usages of it have migrated to Table[Backend].

Signed-off-by: Jussi Maki <jussi@isovalent.com>
@joamaki
dial: Use Table[Frontend] for looking up address
9759898 
As the Resource[*Service] is being removed refactor pkg/dial to instead
look up the ClusterIP address for a service from the frontends table.

Signed-off-by: Jussi Maki <jussi@isovalent.com>
@joamaki
loadbalancer/reflectors: Reflect services directly
aa04bcb 
Stop using Resource[*Service] and reflect services directly into the tables
with [k8s.ListerWatcherToObservable]. Drop the now unused Resource[*Service].

Signed-off-by: Jussi Maki <jussi@isovalent.com>
@joamaki
loadbalancer: Fix few test flakes
7a7a7b0 
Switching to directly reflecting services and endpoint slices and not using an
informer made things converge a little bit faster and revealed couple flaky tests:

- reuse.txtar was deleting and inserting in quick succession 'test' and 'test2' services
  which lead to upsert of test and test2 back to back causing a conflict. This was because
  a prior delete of 'test2' was replaced by a future upsert and this was processed before
  upsert of 'test' due to preserving the ordering. The implementation is correct as it has
  the same semantics as normal informer + workqueue setup. Fixed the test to sync after each
  sequence of deletes and updates.

- redirectpolicy's service.txtar didn't check that frontends were reconciled causing sometimes
  the reconciler to not process the deletion and thus reusing the frontend IDs when they were
  added back.

Signed-off-by: Jussi Maki <jussi@isovalent.com>
@joamaki
l2announcer: Switch to using Table[Service/Frontend]
1386aca 
Refactor to use Table[*Service] and Table[*Frontend] instead of the
Resource[*slim_corev1.Service].

The Table[*Service] is always updated when frontends change so we're
relying on that to trigger the processing.

Signed-off-by: Jussi Maki <jussi@isovalent.com>
@joamaki
loadbalancer: Fix flake in hybrid-dsr.txtar
12a5eaf 
The TCP and UDP services were added at the same time which
sometimes caused the IDs to be allocated in an unexpected
order. Fix this by adding the TCP service first and waiting
for it to get reconciled and only then add the UDP service.

Signed-off-by: Jussi Maki <jussi@isovalent.com>
@joamaki joamaki force-pushed the pr/joamaki/remove-agent-endpointslice-services-resources branch from e4bd781 to 12a5eaf Compare December 2, 2025 11:07
@joamaki
Copy link
Copy Markdown
Contributor Author

joamaki commented Dec 3, 2025

/test

tklauser
tklauser approved these changes Dec 3, 2025
View reviewed changes
Copy link
Copy Markdown
Member

@tklauser tklauser left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

operator changes look good. Didn't review for my other codeowners (thus re-requesting review from @cilium/ipcache)

@tklauser tklauser requested a review from a team December 3, 2025 10:48
gandro
gandro reviewed Dec 3, 2025
View reviewed changes
Copy link
Copy Markdown
Member

@gandro gandro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IPCache looks good to me, but a minor concern regarding DNSUnloadOnShutdown

gandro
gandro approved these changes Dec 3, 2025
View reviewed changes
Copy link
Copy Markdown
Member

@gandro gandro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Apparently my concerns regarding DNSUnloadOnShutdown were not correct (c.f. https://github.com/cilium/cilium/pull/42440/files#r2584707929)

@maintainer-s-little-helper maintainer-s-little-helper bot added the ready-to-merge This PR has passed all tests and received consensus from code owners to merge. label Dec 3, 2025
@joamaki joamaki added this pull request to the merge queue Dec 4, 2025
Merged via the queue into cilium:main with commit b44725f Dec 4, 2025
77 checks passed
@joamaki joamaki deleted the pr/joamaki/remove-agent-endpointslice-services-resources branch December 4, 2025 08:31
@rastislavs rastislavs mentioned this pull request Dec 16, 2025
Merged
nezdolik pushed a commit to nezdolik/cilium that referenced this pull request Jan 14, 2026
@nebril
main-ce: Sync with upstream main branch 2025-12-16 (cilium#9613)
5cc98e2 
1. Cherry picked commits from
isovalent/cilium#9533 to reduce conflicts.
Thanks @julianwiedmann
2. Resolved conflicts in:
	- install/kubernetes/cilium/README.md
	- install/kubernetes/cilium/templates/cilium-configmap.yaml
	- install/kubernetes/cilium/values.yaml.tmpl
	- pkg/option/config.go
	- pkg/proxy/proxy_test.go
	- go.mod
	- enterprise/pkg/lb/metrics/metrics.go cc: @mhofstetter 
	- enterprise/pkg/hubble/export/timescape.go cc: @joamaki 
3. Applied [the
patch](https://isovalent.slack.com/archives/C02HCGENRF0/p1765447076513119?thread_ts=1765380293.038119&cid=C02HCGENRF0).
Thanks @tklauser
4. Resolved conflicts related to policy changes in upstream: (cc:
@jrajahalme, thanks for help!)
	- pkg/fqdn/dnsproxy/enterprise_getallrules.go
	- enterprise/fqdn-proxy/watcher.go
	- enterprise/pkg/ingresspolicy/policy.go
	- enterprise/pkg/ingresspolicy/mock_test.go
	- enterprise/pkg/ingresspolicy/ingress_policy.go
	- enterprise/pkg/fqdnha/tables/proxyconfig.go
	- enterprise/pkg/fqdnha/remoteproxy/proxy_test.go
	- enterprise/pkg/fqdnha/doubleproxy/remote_proxy_test.go
	- enterprise/pkg/fqdnha/doubleproxy/doubleproxy_test.go
	- enterprise/pkg/encryption/policy/policy.go
5. Run the following commands:
	- go mod tidy && go mod vendor && go mod verify
	- make -C images update-builder-image update-runtime-image
	- make -C install/kubernetes
	- make -C Documentation update-helm-values
	- make -C Documentation update-cmdref
	- cd enterprise/hubble-timescape && go mod tidy && cd ../..
	- ./contrib/scripts/enterprise-testowners.sh
	- make generate-enterprise-apis
	- make generate-k8s-api && make manifests
	- make -C pkg/bpf/testdata docker
6. Enterprise fixes to make Go linter happy:
	- cilium-cli/enterprise/hooks/cli/ilb/lb_http_clientip.go [line: 211]
- enterprise/pkg/bgpv1/agent/commands/route_policies.go [lines: 240,
251]
	- enterprise/operator/pkg/lb/lbservice_translation_t2.go [line: 800]
	- enterprise/pkg/lb/status/model_lb_status.go [line: 215]
7. Enterprise LB service metric cache commented out (related upstream
[PR](cilium#42440)), this needs to be
addressed in a separate PR: @joamaki
  	- enterprise/pkg/lb/metrics/cell.go
 	- enterprise/pkg/lb/metrics/metrics.go
8. Enterprise tests fixed with
[patch1](https://isovalent.slack.com/archives/C054TA28U78/p1765985477262409?thread_ts=1765980802.058719&cid=C054TA28U78)
and
[patch2](https://isovalent.slack.com/archives/C054TA28U78/p1765991065279899?thread_ts=1765980802.058719&cid=C054TA28U78)
from @rastislavs, thanks!
@cilium-release-bot cilium-release-bot bot moved this to Released in cilium v1.19.0 Feb 3, 2026
@odinuge odinuge mentioned this pull request Feb 13, 2026
Closed
3 tasks
@41ks 41ks mentioned this pull request Feb 25, 2026
Closed
3 tasks
@julianwiedmann julianwiedmann mentioned this pull request Mar 12, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tklauser tklauser tklauser approved these changes

@gandro gandro gandro approved these changes

@dylandreimerink dylandreimerink dylandreimerink approved these changes

@marseel marseel marseel approved these changes

@jrajahalme jrajahalme jrajahalme approved these changes

Assignees

No one assigned

Labels

ready-to-merge This PR has passed all tests and received consensus from code owners to merge. release-note/misc This PR makes changes that have no direct user impact.

Projects

No open projects
cilium v1.19.0
Status: Released

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

7 participants

@joamaki @gandro @tklauser @dylandreimerink @marseel @jrajahalme @msune