Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Exclude terminated Pods from group members #6508

Merged
merged 1 commit into from
Jul 9, 2024

Conversation

tnqn
Copy link
Member

@tnqn tnqn commented Jul 5, 2024

When calculating AddressGroups, terminated Pods should be excluded because their IPs can be recycled and reused by other active Pods.

When calculating AppliedToGroups and EgressGroups, terminated Pods could be excluded as their network resources including network interfaces have been deleted.

Fixes #6507

@tnqn tnqn added action/backport Indicates a PR that requires backports. action/release-note Indicates a PR that should be included in release notes. labels Jul 5, 2024
@tnqn tnqn added this to the Antrea v2.1 release milestone Jul 5, 2024

import v1 "k8s.io/api/core/v1"

func IsPodTerminal(pod *v1.Pod) bool {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IsPodTerminated?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I saw this function name in kubernetes several times, e.g. https://github.com/kubernetes/kubernetes/blob/release-1.30/staging/src/k8s.io/endpointslice/util/controller_utils.go#L95-L98.

I just found there is a public util function IsPodTerminal in "k8s.io/kubernetes/pkg/api/v1/pod" and changed to use it.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just realized this is in an internal package of kubernetes, so still have to define our own one.

@@ -371,9 +372,9 @@ func (c *EgressController) syncEgress(key string) error {
egressGroup := egressGroupObj.(*antreatypes.EgressGroup)
pods, _ := c.groupingInterface.GetEntities(egressGroupType, key)
for _, pod := range pods {
// Ignore Pod if it's not scheduled or not running. And Egress does not support HostNetwork Pods, so also ignore
// Ignore Pod if it's not scheduled or is already terminal. And Egress does not support HostNetwork Pods, so also ignore
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

terminated

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated

When calculating AddressGroups, terminated Pods should be excluded
because their IPs can be recycled and reused by other active Pods.

When calculating AppliedToGroups and EgressGroups, terminated Pods could
be excluded as their network resources including network interfaces have
been deleted.

Signed-off-by: Quan Tian <quan.tian@broadcom.com>
@tnqn tnqn changed the title Exclude terminal Pods from group members Exclude terminated Pods from group members Jul 8, 2024
@tnqn
Copy link
Member Author

tnqn commented Jul 8, 2024

/test-all

@tnqn
Copy link
Member Author

tnqn commented Jul 9, 2024

/test-all

@tnqn tnqn merged commit ff3f7a6 into antrea-io:main Jul 9, 2024
54 of 58 checks passed
@tnqn tnqn deleted the fix-networkpolicy branch July 9, 2024 05:44
tnqn added a commit to tnqn/antrea that referenced this pull request Jul 9, 2024
When calculating AddressGroups, terminated Pods should be excluded
because their IPs can be recycled and reused by other active Pods.

When calculating AppliedToGroups and EgressGroups, terminated Pods could
be excluded as their network resources including network interfaces have
been deleted.

Signed-off-by: Quan Tian <quan.tian@broadcom.com>
tnqn added a commit to tnqn/antrea that referenced this pull request Jul 9, 2024
When calculating AddressGroups, terminated Pods should be excluded
because their IPs can be recycled and reused by other active Pods.

When calculating AppliedToGroups and EgressGroups, terminated Pods could
be excluded as their network resources including network interfaces have
been deleted.

Signed-off-by: Quan Tian <quan.tian@broadcom.com>
tnqn added a commit that referenced this pull request Jul 10, 2024
When calculating AddressGroups, terminated Pods should be excluded
because their IPs can be recycled and reused by other active Pods.

When calculating AppliedToGroups and EgressGroups, terminated Pods could
be excluded as their network resources including network interfaces have
been deleted.

Signed-off-by: Quan Tian <quan.tian@broadcom.com>
tnqn added a commit that referenced this pull request Jul 10, 2024
When calculating AddressGroups, terminated Pods should be excluded
because their IPs can be recycled and reused by other active Pods.

When calculating AppliedToGroups and EgressGroups, terminated Pods could
be excluded as their network resources including network interfaces have
been deleted.

Signed-off-by: Quan Tian <quan.tian@broadcom.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
action/backport Indicates a PR that requires backports. action/release-note Indicates a PR that should be included in release notes.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Network policy fails when completed pods and running pods have the same IP
3 participants