OwnerReferences removal by Cilium Operator

[IvanProdaiko94]

OwnerReferences removal by Cilium Operator

[chaunceyjiang]

@IvanProdaiko94 Have you tried this step in the latest version of Cilium? I seem unable to reproduce this issue in the latest version.

[youngnick]

Thanks for this issue @IvanProdaiko94, this is most likely associated with either the code that handles L2 announcements (and so handles Loadbalancer services) or the Ingress and Gateway code being aggressive in trimming ownerReferences. I've marked it for someone to take a look at.

[chaunceyjiang]

but bgp is not assigning the IP for LoadBalancer. I assume, that if only the bgp tried to assign the IP, it will do a removal as well

I will try to reproduce it locally.

[IvanProdaiko94]

@chaunceyjiang it seems you're right

[IvanProdaiko94]

@chaunceyjiang @youngnick So, folks.
I checked 1.13.3, 1.14.10, 1.15.4 and all of them remove ownerReferences. With 1.16.0-pre.2 running on cluster ownerReferences are not removed, but bgp is not assigning the IP for LoadBalancer. I assume, that if only the bgp tried to assign the IP, it will do a removal as well

[chaunceyjiang]

I checked 1.13.3, 1.14.10, 1.15.4 and all of them remove ownerReferences.

It seems like I also can't reproduce it.

root@node1:~/cilium# kubectl get svc nginx-loadbalancer-service -oyaml
apiVersion: v1
kind: Service
metadata:
  creationTimestamp: "2024-05-30T08:12:13Z"
  labels:
    a: b
  name: nginx-loadbalancer-service
  namespace: default
  ownerReferences:
  - apiVersion: v1
    blockOwnerDeletion: true
    controller: true
    kind: Pod
    name: gpu-brun-695c587cdc-klq86
    uid: c45f48df-66b6-4300-b3f5-eda0c2a2e1a3
  resourceVersion: "51694462"
  uid: 21cde266-2c0a-4389-9641-bf34c2eed822
spec:
  allocateLoadBalancerNodePorts: true
  clusterIP: 10.96.144.66
  clusterIPs:
  - 10.96.144.66
  externalTrafficPolicy: Cluster
  internalTrafficPolicy: Cluster
  ipFamilies:
  - IPv4
  ipFamilyPolicy: SingleStack
  ports:
  - name: http
    nodePort: 31767
    port: 80
    protocol: TCP
    targetPort: 8080
  selector:
    app: nginx
  sessionAffinity: None
  type: LoadBalancer
status:
  conditions:
  - lastTransitionTime: "2024-05-30T08:32:19Z"
    message: ""
    reason: satisfied
    status: "True"
    type: cilium.io/IPAMRequestSatisfied
  loadBalancer:
    ingress:
    - ip: 172.30.126.134

[PhilipSchmid]

The MetalLB-based BGP implementation (deprecated) seems to always remove the ownerReferences. The new Cilium go-bgp-based BGP Control Plance doesn't. Solution/workaround: Use the new BGP Control Plane.

IMO, this issue could be closed.