l2announcer: leader-election Lease name is a plain namespace+name concatenation, so two Services can end up sharing one Lease #48084

Is there an existing issue for this?

• I have searched the existing issues

Version

equal or higher than v1.19.6 and lower than v1.20.0

What happened?

L2 announcements derive the per-Service leader-election Lease name by gluing the namespace and the Service name onto a prefix with a hyphen, and a hyphen is legal inside both halves. Two unrelated Services can therefore map onto the same Lease name and end up in one leader election.

const leasePrefix = "cilium-l2announce"
Name: fmt.Sprintf("%s-%s-%s", leasePrefix, svc.Name.Namespace(), svc.Name.Name()),

Namespace foo + Service bar-baz, and namespace foo-bar + Service baz, both produce cilium-l2announce-foo-bar-baz. There is no sanitization, escaping or hashing anywhere on that path; the only other place the name is touched is the GC scan, which just prefix-matches (strings.HasPrefix(lease.Name, leasePrefix)) and does not disambiguate either. Same code on v1.19:

Expected: one Lease per Service.

Mechanism

Impact

Needs a hyphen in the right place, so it is not going to be common, but it is silent when it happens and the symptom points at the L2 policy rather than at a name collision. Multi-tenant clusters where namespaces are generated with a prefix (team-a, team-a-staging) and Service names are equally hyphenated are where I would expect it.

Suggested fix

Use a separator that cannot appear in either half. Neither a namespace (DNS-1123 label) nor a Service name (DNS-1035 label) may contain ., and . is legal in an object name (DNS-1123 subdomain), so fmt.Sprintf("%s-%s.%s", leasePrefix, ns, name) is unambiguous and stays readable in kubectl get leases. A hash suffix would also work but costs readability.

Either way the name changes on upgrade, which orphans the existing Leases. Those are released on agent shutdown (ReleaseOnCancel), which empties the holder identity, and leaseGC already deletes prefix-matching Leases with an empty holder, so the old objects should clean themselves up. I have not confirmed that.

How can we reproduce the issue?

1. Enable L2 announcements and a CiliumLoadBalancerIPPool.
2. kubectl create namespace foo && kubectl create namespace foo-bar
3. Create Service bar-baz of type LoadBalancer in foo, and Service baz of type LoadBalancer in foo-bar.
4. Create CiliumL2AnnouncementPolicy objects selecting both, with disjoint nodeSelectors so the two Services are announced from different nodes.
5. kubectl get leases -n kube-system | grep cilium-l2announce shows one Lease named cilium-l2announce-foo-bar-baz instead of two.

Cilium Version

N/A — found by source inspection, no live cluster involved.

Kernel Version

N/A — found by source inspection, no live cluster involved.

Kubernetes Version

N/A — found by source inspection, no live cluster involved.

Regression

No response

Sysdump

No response

Relevant log output

Anything else?

No response

Cilium Users Document

• Are you a user of Cilium? Please add yourself to the Users doc

Code of Conduct

• I agree to follow this project's Code of Conduct