Commit graph

2383 commits

Author SHA1 Message Date
Kubernetes Prow Robot
a3ac5144e7
Merge pull request #137501 from danwinship/nftables-list-redux
Fix kube-proxy on systems with nft 1.1.3 (take 2)
2026-03-12 19:41:45 +05:30
Kubernetes Prow Robot
958c10e37e
Merge pull request #137370 from Nordix/fix-double-bind
fix(kube-proxy): fix health check binding failure in case of dual-stack
2026-03-12 03:01:43 +05:30
Alessio Attilio
117df3de4d pkg/proxy/nftables: fix kube-proxy crash with newer nftables versions
Fixes kube-proxy's nftables mode to work on systems with nft 1.1.3.
2026-03-11 10:50:07 -04:00
Kubernetes Prow Robot
05c01a2e80
Merge pull request #136499 from danwinship/nftables-hairpin-2
further nftables masquerading improvements
2026-03-07 03:32:17 +05:30
Patrick Ohly
b895ce734f golangci-lint: bump to logtools v0.10.1
This fixes a bug that caused log calls involving `klog.Logger` to not be
checked.

As a result we have to fix some code that is now considered faulty:

    ERROR: pkg/controller/serviceaccount/tokens_controller.go:382:1: A function should accept either a context or a logger, but not both. Having both makes calling the function harder because it must be defined whether the context must contain the logger and callers have to follow that. (logcheck)
    ERROR: func (e *TokensController) generateTokenIfNeeded(ctx context.Context, logger klog.Logger, serviceAccount *v1.ServiceAccount, cachedSecret *v1.Secret) ( /* retry */ bool, error) {
    ERROR: ^
    ERROR: pkg/controller/storageversionmigrator/storageversionmigrator.go:299:1: A function should accept either a context or a logger, but not both. Having both makes calling the function harder because it must be defined whether the context must contain the logger and callers have to follow that. (logcheck)
    ERROR: func (svmc *SVMController) runMigration(ctx context.Context, logger klog.Logger, gvr schema.GroupVersionResource, resourceMonitor *garbagecollector.Monitor, toBeProcessedSVM *svmv1beta1.StorageVersionMigration, listResourceVersion string) (err error, failed bool) {
    ERROR: ^
    ERROR: pkg/proxy/node.go:121:3: logging function "Error" should not use format specifier "%q" (logcheck)
    ERROR: 		klog.FromContext(ctx).Error(nil, "Timed out waiting for node %q to exist", nodeName)
    ERROR: 		^
    ERROR: pkg/proxy/node.go:123:3: logging function "Error" should not use format specifier "%q" (logcheck)
    ERROR: 		klog.FromContext(ctx).Error(nil, "Timed out waiting for node %q to be assigned IPs", nodeName)
    ERROR: 		^
    ERROR: pkg/scheduler/backend/queue/scheduling_queue.go:610:1: A function should accept either a context or a logger, but not both. Having both makes calling the function harder because it must be defined whether the context must contain the logger and callers have to follow that. (logcheck)
    ERROR: func (p *PriorityQueue) runPreEnqueuePlugin(ctx context.Context, logger klog.Logger, pl fwk.PreEnqueuePlugin, pInfo *framework.QueuedPodInfo, shouldRecordMetric bool) *fwk.Status {
    ERROR: ^
    ERROR: pkg/scheduler/framework/plugins/dynamicresources/extendeddynamicresources.go:286:1: A function should accept either a context or a logger, but not both. Having both makes calling the function harder because it must be defined whether the context must contain the logger and callers have to follow that. (logcheck)
    ERROR: func (pl *DynamicResources) deleteClaim(ctx context.Context, claim *resourceapi.ResourceClaim, logger klog.Logger) error {
    ERROR: ^
    ERROR: pkg/scheduler/framework/plugins/dynamicresources/extendeddynamicresources.go:499:1: A function should accept either a context or a logger, but not both. Having both makes calling the function harder because it must be defined whether the context must contain the logger and callers have to follow that. (logcheck)
    ERROR: func (pl *DynamicResources) waitForExtendedClaimInAssumeCache(
    ERROR: ^
    ERROR: pkg/scheduler/framework/plugins/dynamicresources/extendeddynamicresources.go:528:1: A function should accept either a context or a logger, but not both. Having both makes calling the function harder because it must be defined whether the context must contain the logger and callers have to follow that. (logcheck)
    ERROR: func (pl *DynamicResources) createExtendedResourceClaimInAPI(
    ERROR: ^
    ERROR: pkg/scheduler/framework/plugins/dynamicresources/extendeddynamicresources.go:592:1: A function should accept either a context or a logger, but not both. Having both makes calling the function harder because it must be defined whether the context must contain the logger and callers have to follow that. (logcheck)
    ERROR: func (pl *DynamicResources) unreserveExtendedResourceClaim(ctx context.Context, logger klog.Logger, pod *v1.Pod, state *stateData) {
    ERROR: ^
    ERROR: pkg/scheduler/framework/runtime/batch.go:171:1: A function should accept either a context or a logger, but not both. Having both makes calling the function harder because it must be defined whether the context must contain the logger and callers have to follow that. (logcheck)
    ERROR: func (b *OpportunisticBatch) batchStateCompatible(ctx context.Context, logger klog.Logger, pod *v1.Pod, signature fwk.PodSignature, cycleCount int64, state fwk.CycleState, nodeInfos fwk.NodeInfoLister) bool {
    ERROR: ^
    ERROR: staging/src/k8s.io/component-base/featuregate/feature_gate.go:890:4: Additional arguments to Info should always be Key Value pairs. Please check if there is any key or value missing. (logcheck)
    ERROR: 			logger.Info("Warning: SetEmulationVersionAndMinCompatibilityVersion will change already queried feature", "featureGate", feature, "oldValue", oldVal, newVal)
    ERROR: 			^
    ERROR: test/images/sample-device-plugin/sampledeviceplugin.go:108:2: logging function "Info" should not use format specifier "%s" (logcheck)
    ERROR: 	logger.Info("pluginSocksDir: %s", pluginSocksDir)
    ERROR: 	^
    ERROR: test/images/sample-device-plugin/sampledeviceplugin.go:123:2: logging function "Info" should not use format specifier "%s" (logcheck)
    ERROR: 	logger.Info("CDI_ENABLED: %s", cdiEnabled)
    ERROR: 	^

While waiting for this to merge, another call was added which also doesn't
follow conventions:

    ERROR: pkg/kubelet/kubelet.go:2454:1: A function should accept either a context or a logger, but not both. Having both makes calling the function harder because it must be defined whether the context must contain the logger and callers have to follow that. (logcheck)
    ERROR: func (kl *Kubelet) deletePod(ctx context.Context, logger klog.Logger, pod *v1.Pod) error {
    ERROR: ^

Contextual logging has been beta and enabled by default for several releases
now. It's mostly just a matter of wrapping up and declaring it GA. Therefore
the calls which directly call WithName or WithValues (always have an effect)
are left as-is instead of converting them to use the klog wrappers (support
disabling the effect). To allow that, the linter gets reconfigured to not
complain about this anymore, anywhere.

The calls which would have to be fixed otherwise are:

    ERROR: pkg/kubelet/cm/dra/claiminfo.go:170:11: function "WithName" should be called through klogr.LoggerWithName (logcheck)
    ERROR: 	logger = logger.WithName("dra-claiminfo")
    ERROR: 	         ^
    ERROR: pkg/kubelet/cm/dra/healthinfo.go:45:11: function "WithName" should be called through klogr.LoggerWithName (logcheck)
    ERROR: 	logger = logger.WithName("dra-healthinfo")
    ERROR: 	         ^
    ERROR: pkg/kubelet/cm/dra/healthinfo.go:89:11: function "WithName" should be called through klogr.LoggerWithName (logcheck)
    ERROR: 	logger = logger.WithName("dra-healthinfo")
    ERROR: 	         ^
    ERROR: pkg/kubelet/cm/dra/healthinfo.go:157:11: function "WithName" should be called through klogr.LoggerWithName (logcheck)
    ERROR: 	logger = logger.WithName("dra-healthinfo")
    ERROR: 	         ^
    ERROR: pkg/kubelet/cm/dra/manager.go:175:12: function "WithName" should be called through klogr.LoggerWithName (logcheck)
    ERROR: 	logger := klog.FromContext(ctx).WithName("dra-manager")
    ERROR: 	          ^
    ERROR: pkg/kubelet/cm/dra/manager.go:239:12: function "WithName" should be called through klogr.LoggerWithName (logcheck)
    ERROR: 	logger := klog.FromContext(ctx).WithName("dra-manager")
    ERROR: 	          ^
    ERROR: pkg/kubelet/cm/dra/manager.go:593:12: function "WithName" should be called through klogr.LoggerWithName (logcheck)
    ERROR: 	logger := klog.FromContext(ctx).WithName("dra-manager")
    ERROR: 	          ^
    ERROR: pkg/kubelet/cm/dra/manager.go:781:12: function "WithName" should be called through klogr.LoggerWithName (logcheck)
    ERROR: 	logger := klog.FromContext(context.Background()).WithName("dra-manager")
    ERROR: 	          ^
    ERROR: pkg/kubelet/cm/dra/manager.go:898:12: function "WithName" should be called through klogr.LoggerWithName (logcheck)
    ERROR: 	logger := klog.FromContext(ctx).WithName("dra-manager")
    ERROR: 	          ^
    ERROR: pkg/kubelet/cm/dra/manager_test.go:1638:15: function "WithName" should be called through klogr.LoggerWithName (logcheck)
    ERROR: 				logger := klog.FromContext(streamCtx).WithName(st.Name())
    ERROR: 				          ^
    ERROR: pkg/kubelet/cm/dra/plugin/dra_plugin.go:77:12: function "WithName" should be called through klogr.LoggerWithName (logcheck)
    ERROR: 	logger := klog.FromContext(ctx).WithName("dra-plugin")
    ERROR: 	          ^
    ERROR: pkg/kubelet/cm/dra/plugin/dra_plugin.go:108:12: function "WithName" should be called through klogr.LoggerWithName (logcheck)
    ERROR: 	logger := klog.FromContext(ctx).WithName("dra-plugin")
    ERROR: 	          ^
    ERROR: pkg/kubelet/cm/dra/plugin/dra_plugin.go:161:12: function "WithName" should be called through klogr.LoggerWithName (logcheck)
    ERROR: 	logger := klog.FromContext(ctx).WithName("dra-plugin")
    ERROR: 	          ^
    ERROR: staging/src/k8s.io/dynamic-resource-allocation/resourceslice/tracker/tracker.go:695:14: function "WithValues" should be called through klogr.LoggerWithValues (logcheck)
    ERROR: 			logger := logger.WithValues("device", deviceID)
    ERROR: 			          ^
    ERROR: test/integration/apiserver/watchcache_test.go:42:54: function "WithName" should be called through klogr.LoggerWithName (logcheck)
    ERROR: 	etcd0URL, stopEtcd0, err := framework.RunCustomEtcd(klog.FromContext(ctx).WithName("etcd0"), "etcd_watchcache0", etcdArgs)
    ERROR: 	                                                    ^
    ERROR: test/integration/apiserver/watchcache_test.go:47:54: function "WithName" should be called through klogr.LoggerWithName (logcheck)
    ERROR: 	etcd1URL, stopEtcd1, err := framework.RunCustomEtcd(klog.FromContext(ctx).WithName("etcd1"), "etcd_watchcache1", etcdArgs)
    ERROR: 	                                                    ^
    ERROR: test/integration/scheduler_perf/scheduler_perf.go:1149:12: function "WithName" should be called through klogr.LoggerWithName (logcheck)
    ERROR: 		logger = logger.WithName(tCtx.Name())
    ERROR: 		         ^
2026-03-04 12:08:18 +01:00
Tero Kauppinen
0659a346ea
fix(kube-proxy): fix health check binding failure in case of dual-stack
In case of dual-stack, kube-proxy tries to bind both IPv4 and IPv6
health check instances to the same address and port pair which causes
the following error message in the log: 'bind: address already in use'.

Fix the issue by binding IPv4 instance to a 'tcp4' socket and IPv6 instance
to a 'tcp6' socket.

Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
2026-03-03 14:20:27 +02:00
Dan Winship
475f9622c8 Squash nftables endpoint chains into service vmap
We only need a separate chain for the endpoints if the service uses affinity.
2026-03-02 11:05:52 -05:00
Dan Winship
e17963cb99 Do nftables hairpin handling centrally rather than per-endpoint 2026-03-02 11:05:52 -05:00
Dan Winship
aa3a30d134 Do clusterIP masquerading centrally rather than per-service 2026-03-02 11:05:52 -05:00
Dan Winship
75aab220b4 Add NodeName to all EndpointSlices in nftables proxier unit tests
Previously it was leaving NodeName unset in many cases. Give all of
the endpoints an explicit NodeName, making them explicitly local in
all the test cases that don't care either way, and explicitly
non-local in those test cases that did care but were previously just
relying on the fact that a nil NodeName would be treated as remote.
2026-03-02 11:05:50 -05:00
Dan Winship
ea8bad22e6 Revert "pkg/proxy/nftables: fix kube-proxy crash with newer nftables versions"
This reverts commit 72ef5b34a8.
2026-02-20 08:28:25 -05:00
Mads Jensen
bbbc09fb11 proxy/utils: Use net.JoinHostPort to format address. 2026-02-15 16:53:17 +01:00
Kubernetes Prow Robot
5b63a8c68e
Merge pull request #136921 from dims/dump-from-utils
Move dump package from apimachinery to k8s.io/utils
2026-02-12 22:28:10 +05:30
Davanum Srinivas
550cc8645b
Move dump package from apimachinery to k8s.io/utils
Replace all imports of k8s.io/apimachinery/pkg/util/dump with
k8s.io/utils/dump across the repo. The apimachinery dump package
now contains deprecated wrapper functions that delegate to
k8s.io/utils/dump for backwards compatibility.

Signed-off-by: Davanum Srinivas <davanum@gmail.com>
2026-02-12 07:34:19 -05:00
Alessio Attilio
72ef5b34a8 pkg/proxy/nftables: fix kube-proxy crash with newer nftables versions
Fixes kube-proxy's nftables mode to work on systems with nft 1.1.3.
2026-02-11 21:46:23 +01:00
ansilh
440cfca4ef refactor(kube-proxy): remove redundant empty endpoints check in topologyModeFromHints
The len(endpoints) == 0 check is now redundant since the hasReadyEndpoints
check handles this case when the slice is empty, the loop executes zero
times, hasReadyEndpoints stays false, and returns "" via the same path.
2026-02-06 21:56:58 +05:30
ansilh
18f56fa7c7 fix(kube-proxy): skip topology hints logging when no ready endpoints exist
When all endpoints are non-ready (ready=false, serving=false, terminating=false),
the topologyModeFromHints function was incorrectly logging "Ignoring same-zone
topology hints for service since no hints were provided for zone" because the
boolean flags remained at their initial values after the loop skipped all
non-ready endpoints.

This fix adds tracking for whether any ready endpoints were processed and
returns early if none exist, avoiding misleading log messages.

Also adds a test case covering this scenario.
2026-02-06 21:46:05 +05:30
Kubernetes Prow Robot
437184c055
Merge pull request #136292 from atombrella/feature/modernize_plusbuild
Remove obsolete `// +build` instruction.
2026-01-26 19:05:59 +05:30
Dan Winship
3c1ad42773 Add a helper for the operation-counting unit tests in nftables
(This will make it easier to keep the counts in sync when we change
things.)
2026-01-24 09:42:42 -05:00
Kubernetes Prow Robot
7cdeb11327
Merge pull request #135800 from danwinship/nftables-hairpin
rework nftables masquerading code, part 1
2026-01-24 10:33:39 +05:30
Prince Pereira
4198b789f5 Fix for preferred dualstack and required dualstack in winkernel proxier. 2026-01-21 00:57:09 +05:30
Mads Jensen
64a7d4c741 Remove deprecated +build instruction. 2026-01-19 17:40:33 +01:00
Dan Winship
5cffb4d1f6 Remove mark-for-masquerade chain from nftables kube-proxy
Current kernels have problems with very large rulesets with lots of
jumps (because of inefficiency in the code that ensures the jumps
don't create loops). Get rid of a bunch of jumps (1 per endpoint and
usually 1 or 2 per service) by just doing mark-for-masquerade inline
rather than calling a helper chain to do it.
2026-01-09 12:51:24 -05:00
Dan Winship
36673b618e Rework masquerade handling in nftables tracer
Process the actual rules rather than treating
"jump mark-for-masquerade" as having special semantics.
2026-01-09 12:50:26 -05:00
Dan Winship
c3595012b5 Simplify nftables masquerade rule
We originally made it multiple rules, matching iptables, but nftables
lets you do it all in a single rule.
2026-01-09 12:46:37 -05:00
Kubernetes Prow Robot
25b452b971
Merge pull request #135631 from danwinship/ipvs-winkernel-resync-period
Switch ipvs and winkernel back to more regular forced syncs
2026-01-09 02:11:46 +05:30
Patrick Ohly
ad79e479c2 build: remove deprecated '// +build' tag
This has been replaced by `//build:...` for a long time now.

Removal of the old build tag was automated with:

    for i in $(git grep -l '^// +build' | grep -v -e '^vendor/'); do if ! grep -q '^// Code generated' "$i"; then sed -i -e '/^\/\/ +build/d' "$i"; fi; done
2025-12-18 12:16:21 +01:00
Kubernetes Prow Robot
2fa93a995e
Merge pull request #135593 from danwinship/proxy-duplicate-ips
Handle the case of a pod IP being reused while the old Pod still exists
2025-12-17 23:28:02 -08:00
Kubernetes Prow Robot
101ee1bc9c
Merge pull request #135549 from danwinship/proxy-backend-files
Split up `pkg/proxy/*/proxier.go` a bit more
2025-12-17 23:27:54 -08:00
Kubernetes Prow Robot
1faee42453
Merge pull request #135548 from danwinship/conntrack-setup
Move kube-proxy conntrack setup code to pkg/proxy
2025-12-17 23:27:46 -08:00
Kubernetes Prow Robot
77f5336dbc
Merge pull request #135547 from danwinship/healthcheck-interface
Add a nodeManager interface to pkg/proxy/healthcheck
2025-12-17 23:27:38 -08:00
Dan Winship
1e61027d75 Switch ipvs and winkernel back to more regular forced syncs 2025-12-05 11:28:32 -05:00
Dan Winship
e1b20366e3 Handle the case of a pod IP being reused while the old Pod still exists
If the pod network reuses a pod IP while the old pod is still
terminating, then we may temporarily see two Endpoints for that IP. In
that case, prefer the non-terminating one.
2025-12-04 10:35:34 -05:00
Dan Winship
bc8aa8c067 Remove incorrect special-case when Endpoints move between EndpointSlices
The code was assuming that if an Endpoint got moved from one slice to
another, and one is "local" but the other isn't, then we should prefer
the local one. But this doesn't make sense; if it's actually the same
Endpoint (i.e., same targetRef) then both copies will have the same
Hostname. And if it's not the same Endpoint, then one of the two
Endpoints is wrong, but there's no reason to assume it's the non-local
one.
2025-12-04 10:30:00 -05:00
Antonio Ojea
38e08c231c kube-proxy: optimize conntrack cleanup with O(n) flow filter
Previously, we created a separate filter for each stale flow,
resulting in O(n^2) complexity when deleting flows because the
netlink llibrary iterates over all filters for each flow.

This change introduces a new filter backed by a `sets.Set` for O(1) lookup per flow.
This reduces the overall complexity of cleaning up stale entries to O(n).
2025-12-03 10:35:29 +00:00
Dan Winship
531be81208 Move proxier cleanup code into separate files.
(No code changes, just moving between files.)
2025-12-02 11:05:00 -05:00
Dan Winship
9f4edccb97 Move proxier supportedness-checking code into separate files.
(No code changes, just moving between files.)
2025-12-02 11:05:00 -05:00
Dan Winship
fe84ab85f1 Move conntrack sysctl setup from cmd/kube-proxy/ to pkg/proxy/conntrack/
Eventually this code will be called from the backends themselves.
2025-12-02 11:03:00 -05:00
Dan Winship
3ecc3c9e6e Clean up some code we're about to move
So linter-hints won't complain about it in the new file.
2025-12-02 09:54:56 -05:00
Dan Winship
d6d3bc88a1 Add an interface type to prevent a future import loop 2025-12-01 18:40:12 -05:00
Prince Pereira
a49bc6f2fb kube-proxy/winkernel: fix stale RemoteEndpoints due to premature clearing of terminatedEndpoints map. 2025-11-05 16:23:43 +00:00
Dan Winship
715228f478 Remove LoadBalancerIPMode feature gate 2025-10-24 09:12:03 -04:00
Kubernetes Prow Robot
6652c9fadf
Merge pull request #134457 from danwinship/prefersamenode
KEP-3015: update PreferSameTrafficDistribution to GA
2025-10-23 14:41:33 -07:00
novahe
9d48e7d2d4 fix missing involvedObject.apiVersion in event 2025-10-22 20:13:36 +08:00
Dan Winship
02926c9563 Update PreferSameTrafficDistribution to GA 2025-10-14 08:20:43 -04:00
Kubernetes Prow Robot
9f40c6f62c
Merge pull request #134137 from aditigupta96/refactor-core-waitfornamedcachesync
refactor: Use WaitForNamedCacheSyncWithContext in core components
2025-09-23 01:32:16 -07:00
Aditi Gupta
f44279647b refactor: Use WaitForNamedCacheSyncWithContext in core components
Signed-off-by: Aditi Gupta <aditigpta@google.com>
2025-09-18 11:34:28 -07:00
Dan Winship
f8bfcfc885 Drop utiliptables.NewDualStack()
The semantics (sometimes it returns an error that is really just a
warning) are too confusing, and it turns out that we really only need
it in one place (platformCheckSupported()); after that we've already
figured out what IP families are supported, so we could just use
utiliptables.NewBestEffort() instead, knowing we want exactly what it
returns.

So we can just expand the semantics of the old NewDualStack() inline
in the one place we care, without hiding any of it behind a
too-complicated return value.
2025-09-17 20:14:28 -04:00
Kubernetes Prow Robot
053267ad36
Merge pull request #134024 from jack4it/jack4it/iifname
fix: use iifname for input interface name matches
2025-09-16 15:28:17 -07:00
Jack Ma
b81e87c02f fix: use iifname for input interface name matches
add tests to cover nftables; also fix NewDetectLocalByBridgeInterface
2025-09-12 09:39:08 -07:00