clustermesh: add local endpointslice mirror controller by MrFreezeex · Pull Request #38596 · cilium/cilium

MrFreezeex · 2025-03-29T01:19:08Z

Please ensure your pull request adheres to the following guidelines:

For first time contributors, read Submitting a pull request
All code is covered by unit and/or runtime tests where feasible.
All commits contain a well written commit description including a title,
description and a Fixes: #XXX line if the commit addresses a particular
GitHub issue.
If your commit description contains a Fixes: <commit-id> tag, then
please add the commit author[s] as reviewer[s] to this issue.
All commits are signed off. See the section Developer’s Certificate of Origin
Provide a title or release-note blurb suitable for the release notes.
Are you a user of Cilium? Please add yourself to the Users doc
Thanks for contributing!

Add a new controller that mirror local EndpointSlice instead of relying on copying the selector of the local Service.

This fixes two issues:

We were not supporting EndpointSlices not create via selectors which was a known limitation of the existing implementation
Hostnames were not correctly synchronized with MCS-API. This is because usually hostnames in EndpointSlice are set via a StatefulSet to its governing Services. However in the previous implementation because we effectively change the Service name we were not able to have any hostname set.

This new mirroring controller does fixes those two issues because no selectors are now involved and we fully control the content of the EndpointSlice that we create instead of relying on the controller inside kube-controller-manager.

This new controller uses the suffix of the EndpointSlice as key and mirror the content of two EndpointSlice with the same key.

clustermesh: add a new MCS-API controller mirroring the local EndpointSlice instead of copying the Service selectors. Cilium MCS-API now support EndpointSlice created outside of Service selectors and it fixes hostname synchronization in the context of MCS-API.

MrFreezeex · 2025-03-30T16:17:35Z

/test

MrFreezeex · 2025-03-30T17:11:32Z

/test

MrFreezeex · 2025-03-30T17:24:18Z

/test

giorio94

Thanks! I've started taking a first look, and left a few suggestions/questions inline.

One additional aspect that may be worth considering is that the derived service may not exactly match the original service, both due to conflict resolution, and because of address family differences (if I'm not mistaken, derived services are always IPv4 only, which is a suboptimal). Hence, plainly copying the epslices may not necessarily be strictly correct in all cases. While conflicts (only ports should affect the behavior) may be considered niche enough to be neglected, address family behavior may need additional considerations.

pkg/clustermesh/mcsapi/endpointslice_mirror_controller.go

MrFreezeex · 2025-04-07T14:27:23Z

Thanks! I've started taking a first look, and left a few suggestions/questions inline.

Thanks for the review 🙏

One additional aspect that may be worth considering is that the derived service may not exactly match the original service, both due to conflict resolution, and because of address family differences (if I'm not mistaken, derived services are always IPv4 only, which is a suboptimal). Hence, plainly copying the epslices may not necessarily be strictly correct in all cases. While conflicts (only ports should affect the behavior) may be considered niche enough to be neglected, address family behavior may need additional considerations.

Yep that's true we might want to copy the ports from the derived service instead to fix that. As for IP family that's a very good catch too, I think the correct thing to do here would be to ignore EndpointSlice that do not match the IP family of the derived Service which should match the previous behavior.

The IP family of the derived Service being right now whatever the default is when creating a new Service and I am pretty sure they could be dual stack and not only IPV4. Now I am not sure what would be best between trying to match the IP family of the exported service or keeping the default when the service is created... If we match the IP family it would means that starting to export a Service locally with a different IP family than the default might trigger a deletion+recreation of the derived Service? In any case this would probably need a separate PR if we need to change this 👀

giorio94 · 2025-04-07T15:47:28Z

One additional aspect that may be worth considering is that the derived service may not exactly match the original service, both due to conflict resolution, and because of address family differences (if I'm not mistaken, derived services are always IPv4 only, which is a suboptimal). Hence, plainly copying the epslices may not necessarily be strictly correct in all cases. While conflicts (only ports should affect the behavior) may be considered niche enough to be neglected, address family behavior may need additional considerations.

Yep that's true we might want to copy the ports from the derived service instead to fix that.

👍

As for IP family that's a very good catch too, I think the correct thing to do here would be to ignore EndpointSlice that do not match the IP family of the derived Service which should match the previous behavior.

Yep, that sounds a reasonable approach for the moment. Or if we agree on matching the family of the local service, then it is fine to ignore this mismatch, and get it fixed afterwards.

The IP family of the derived Service being right now whatever the default is when creating a new Service and I am pretty sure they could be dual stack and not only IPV4.

The default is SingleStack actually.

  ipFamilyPolicy        <string>
  enum: PreferDualStack, RequireDualStack, SingleStack
    IPFamilyPolicy represents the dual-stack-ness requested or required by this
    Service. If there is no value provided, then this field will be set to
    SingleStack. Services can be "SingleStack" (a single IP family),
    "PreferDualStack" (two IP families on dual-stack configured clusters or a
    single IP family on single-stack clusters), or "RequireDualStack" (two IP
    families on dual-stack configured clusters, otherwise fail). The ipFamilies
    and clusterIPs fields depend on the value of this field. This field will be
    wiped when updating a service to type ExternalName.

Now I am not sure what would be best between trying to match the IP family of the exported service or keeping the default when the service is created... If we match the IP family it would means that starting to export a Service locally with a different IP family than the default might trigger a deletion+recreation of the derived Service?

Yep, this is a bit tricky, because the ServiceImport does not expose information on this setting in remote clusters. Matching the local family seems a sensible approach to me though, so that the behavior is consistent. The field is mutable AFAIR, so it should not be a big problem from that point of view.

In any case this would probably need a separate PR if we need to change this 👀

👍

MrFreezeex · 2025-04-28T21:54:04Z

/test

giorio94 · 2025-05-19T09:31:23Z

/test

giorio94

Thanks! One more comment inline. Additionally, the cilium operator's cluster role should be also updated to allow endpointslice write operations when MCS-API is enabled, as this controller would otherwise fail due to lack of permissions if epslice synchronization is disabled.

pkg/clustermesh/mcsapi/endpointslice_mirror_controller.go

giorio94 · 2025-05-19T10:17:40Z

The Conformance Multi Pool IPAM failure should be addressed by a rebase, while the AWS-CNI one is clearly an infra flake.

MrFreezeex · 2025-05-19T11:41:57Z

(rebasing below this point this to ease review)

Add a new controller that mirror local EndpointSlice instead of relying on copying the selector of the local Service. This fixes two issues: - We were not supporting EndpointSlices not create via selectors which was a known limitation of the existing implementation - Hostnames were not correctly synchronized with MCS-API. This is because usually hostnames in EndpointSlice are set via a StatefulSet to its governing Services. However in the previous implementation because we effectively change the Service name we were not able to have any hostname set. This new mirroring controller does fixes those two issues because no selectors are now involved and we fully control the content of the EndpointSlice that we create instead of relying on the controller inside kube-controller-manager. This new controller uses the suffix of the EndpointSlice as key and mirror the content of two EndpointSlice with the same key. Signed-off-by: Arthur Outhenin-Chalandre <[email protected]>

This commit attempt to recover nicely on tricky cases where the service name label is remove from EndpointSlice. Signed-off-by: Arthur Outhenin-Chalandre <[email protected]>

MrFreezeex · 2025-05-19T11:42:25Z

/test

MrFreezeex · 2025-05-19T16:59:58Z

The CI seems stuck somehow
/test

MrFreezeex · 2025-05-19T17:18:25Z

/test

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [cilium](https://cilium.io/) ([source](https://github.com/cilium/cilium)) | minor | `1.17.6` -> `1.18.0` | --- ### Release Notes <details> <summary>cilium/cilium (cilium)</summary> ### [`v1.18.0`](https://github.com/cilium/cilium/releases/tag/v1.18.0): 1.18.0 [Compare Source](cilium/cilium@1.17.6...1.18.0) We are excited to announce the **[Cilium 1.18.0](https://github.com/cilium/cilium/releases/tag/v1.18.0)** release! A total of **3298 new commits** have been contributed to this release by a growing community of over **955 developers** and over **22,000 GitHub stars**! ⭐ To keep up to date with all the latest Cilium releases, see [Announcements](https://github.com/cilium/cilium/discussions/categories/announcements) Here's what's new in [v1.18.0](https://github.com/cilium/cilium/releases/tag/v1.18.0): #### 🚠 Networking - **⚖️ Load Balancing Redesign**: The service load-balancing control-plane in the Cilium agent has been redesigned to reduce memory usage and improve future extensibility of load-balancing features ([cilium/cilium#38469](cilium/cilium#38469), [@joamaki](https://github.com/joamaki)) - **🔌 Virtual Network Devices**: Added support for new virtual network device configurations such as VXLAN in IPsec (VinE) and IPIP tunnels ([cilium/cilium#37723](cilium/cilium#37723), [@ldelossa](https://github.com/ldelossa); [cilium/cilium#37346](cilium/cilium#37346), [@gyutaeb](https://github.com/gyutaeb)) - **Ⓜ️ Multiple Egress Gateways**: Egress Gateways policies can now direct traffic towards multiple gateway nodes ([cilium/cilium#39304](cilium/cilium#39304), [@carlos-abad](https://github.com/carlos-abad)) - **🚦 Ingress Rate Limiting**: The bandwidth manager now supports ingress rate limiting ([cilium/cilium#36351](cilium/cilium#36351), [@l1b0k](https://github.com/l1b0k)) - **📢 Multi-Device L2 Announcements**: The L2 pod announcement feature now supports multiple devices ([cilium/cilium#38198](cilium/cilium#38198), [@dylandreimerink](https://github.com/dylandreimerink)) - **🏢 Neighbor Subsystem Rework**: The neighbor subsystem was made more resilient through a new system that reconciles desired neighbor entries with the kernel state ([cilium/cilium#39987](cilium/cilium#39987), [@dylandreimerink](https://github.com/dylandreimerink)) #### 🌐 IPv6 - **🚇 Tunneling Underlay**: The tunneling datapath mode now supports using an IPv6 network underlay, including when configured with IPsec transparent encryption ([cilium/cilium#38296](cilium/cilium#38296), [cilium/cilium#39497](cilium/cilium#39497), [@pchaigno](https://github.com/pchaigno)) - **💬 Kube Proxy Replacement**: Cilium now implements service translation when running on an IPv6 underlay ([cilium/cilium#39074](cilium/cilium#39074), [@pchaigno](https://github.com/pchaigno)) - **📋 Delegated IPAM**: When delegating IP address management to a third party plugin, Cilium now configures IPv6 routes for connectivity if the plugin supports IPv6 ([cilium/cilium#38249](cilium/cilium#38249), [@caorui-io](https://github.com/caorui-io), [@kadevu](https://github.com/kadevu)) - **📦 IP Fragment Support**: Cilium now processes ordered IPv6 fragments to apply policy and routing functionality ([cilium/cilium#38110](cilium/cilium#38110), [@gentoo-root](https://github.com/gentoo-root)) - **🚪 Egress gateway policies** can now match IPv6 address ranges ([cilium/cilium#38452](cilium/cilium#38452), [@rgo3](https://github.com/rgo3)) #### 🛡️ Policy & Observability - **🏷️ Policy Names in Hubble-CLI**: Show the names of (C)CNPs that allowed or denied traffic when monitoring flows in Hubble ([cilium/cilium#39453](cilium/cilium#39453), [@antonipp](https://github.com/antonipp)) - **📝 Policy Log Fields**: A new free-text log field is added to policies, which is exposed in Hubble flows for easy correlation and searching ([cilium/cilium#39902](cilium/cilium#39902), [@squeed](https://github.com/squeed)) - **🛰️ Encapsulated Traffic Decoding**: Hubble decodes encapsulated traffic for deeper introspection into traffic flows ([cilium/cilium#37634](cilium/cilium#37634), [@kaworu](https://github.com/kaworu)) - **🏰 ClusterMesh Policy Restriction**: A new option allows the **cluster** entity to apply only to the local cluster in ClusterMesh environment ([cilium/cilium#39338](cilium/cilium#39338), [@MrFreezeex](https://github.com/MrFreezeex)) - **✨ Enhanced Policy Dashboard**: The Policy section of the Cilium Grafana dashboard has been improved to show more relevant graphs, including policy drops in both directions ([cilium/cilium#36492](cilium/cilium#36492), [cilium/cilium#37445](cilium/cilium#37445), [@squeed](https://github.com/squeed)) #### 🌅 Performance - **📊 Scale Test Results**: Cilium implements policies and services up to 45% faster in higher scale environments (Various; [@marseel](https://github.com/marseel), [cilium/cilium#40227](cilium/cilium#40227)) - **📦 Image Size Reduction**: Docker image sizes are reduced by 32% on arm64 architecture images ([cilium/cilium#40005](cilium/cilium#40005), [@marseel](https://github.com/marseel)) - **⚡ Improved Policy Performance**: The DNS proxy can process large numbers of IPs faster, and the EndpointSelector match implementation has been optimized ([cilium/cilium#39340](cilium/cilium#39340), [@squeed](https://github.com/squeed); [cilium/cilium#40414](cilium/cilium#40414), [@marseel](https://github.com/marseel)) - **🪞 EndpointSlice Mirroring for Multi-Cluster Services**: Clustermesh mirrors EndpointSlice from the local cluster instead of copying the Service selectors when using the MCS-API controller ([cilium/cilium#38596](cilium/cilium#38596), [@MrFreezeex](https://github.com/MrFreezeex)) - **🌐 KVStoreMesh Optimization**: Cross-cluster state distribution is optimized by only synchronizing identities keyed by ID, not by value ([cilium/cilium#36471](cilium/cilium#36471), [@HadrienPatte](https://github.com/HadrienPatte)) - **🧠 Egress Gateway Processing**: Egress gateway policy processing is significantly improved when matching a large number of pods ([cilium/cilium#37714](cilium/cilium#37714), [@giorio94](https://github.com/giorio94)) - **🗑️ Optimized Garbage Collection for Connection Tracking**: Cilium leverages batched iterators for CTMap GC ([cilium/cilium#36288](cilium/cilium#36288), [@tommyp1ckles](https://github.com/tommyp1ckles)) #### ⚙️ Operations - **📈 API Server Connections at Scale**: Improve kube-apiserver connections behavior at scale through failover and setting better jitter and backoff configurations ([cilium/cilium#37601](cilium/cilium#37601), [@aditighag](https://github.com/aditighag); [cilium/cilium#38031](cilium/cilium#38031), [@orange30](https://github.com/orange30); [cilium/cilium#36648](cilium/cilium#36648), [@wedaly](https://github.com/wedaly)) - **🔄 ConfigMap Synchronization**: New option to automatically synchronize ConfigMap changes into the agent and report metrics for when the effective configuration is different from the desired configuration ([cilium/cilium#36510](cilium/cilium#36510), [@ovidiutirla](https://github.com/ovidiutirla)) - **🎓 CRD Promotion to Stable**: Promote **CiliumCIDRGroup**, **CiliumLoadBalancerIPPool** and all **BGP** CRDs to stable API ([cilium/cilium#38940](cilium/cilium#38940), [@christarazi](https://github.com/christarazi); [cilium/cilium#39090](cilium/cilium#39090), [@pippolo84](https://github.com/pippolo84); [cilium/cilium#37765](cilium/cilium#37765), [@rastislavs](https://github.com/rastislavs)) - **⛔ Node Taints Handling**: The cilium-operator Deployment uses a new default set of taints which avoids deploying to a drained node ([cilium/cilium#40137](cilium/cilium#40137), [@Murat](https://github.com/Murat) Parlakisik) - **:wood: Migrate to Slog**: Cilium now uses slog as log library for all components ([cilium/cilium#39664](cilium/cilium#39664), [@aanm](https://github.com/aanm)) - **🔧 Cilium dependencies** were updated to Kubernetes v1.33, Envoy v1.34, LLVM 19.1, and CNI v1.1 ([cilium/cilium#39124](cilium/cilium#39124), [cilium/cilium#40175](cilium/cilium#40175), [cilium/cilium#39632](cilium/cilium#39632), [@sayboras](https://github.com/sayboras); [cilium/cilium#38868](cilium/cilium#38868), [@squeed](https://github.com/squeed)) - **🐧 Minimum Linux Requirements**: The minimum kernel version for this release series is Linux v5.10 or similar, such as RHEL 8.6 ([cilium/cilium#38308](cilium/cilium#38308), [@julianwiedmann](https://github.com/julianwiedmann)) #### 🕸️ Service Mesh & Gateway API - **⛩️ Gateway API v1.3.0**: Gateway API support is bumped to v1.3.0 ([cilium/cilium#39590](cilium/cilium#39590), [@sayboras](https://github.com/sayboras)) - **🔗 Improved GatewayClass Configuration**: The new CiliumGatewayClassConfig object adds service type validation allows the configuration of extra settings on a per-GatewayClass level: LoadBalancerSourceRangesPolicy, ParametersRef fields. This allows Cilium to reconcile multiple GatewayClasses with different configurations ([cilium/cilium#37792](cilium/cilium#37792), [cilium/cilium#37402](cilium/cilium#37402), [cilium/cilium#40138](cilium/cilium#40138), [@sayboras](https://github.com/sayboras)) - **🚏 Multiple HTTPRoutes**: GAMMA reconciler now supports attaching multiple HTTPRoutes to the same Service ([cilium/cilium#39922](cilium/cilium#39922), [@youngnick](https://github.com/youngnick)) - **🪄 Route Changes Reconciliation**: Reconcile Gateway API based on all changes to routes. This allows label updates to trigger reconciliation correctly, amongst other things ([cilium/cilium#37798](cilium/cilium#37798), [@sayboras](https://github.com/sayboras)) #### 🏷️ IP Address Management - **☁️ AWS Prefix Delegation**: Prefix delegation on AWS bare metal instances is now supported natively in Cilium's AWS ENI IPAM mode ([cilium/cilium#39678](cilium/cilium#39678), [@41ks](https://github.com/41ks)) - **🏬 Multi-Pool IPAM with KVStore**: Add support for Multi-Pool IPAM in external KVstore mode ([cilium/cilium#39638](cilium/cilium#39638), [@pippolo84](https://github.com/pippolo84)) - **🔐 Multi-Pool IPAM with IPSec**: Add support for Multi-Pool IPAM mode with IPSec transparent encryption in tunnel routing mode ([cilium/cilium#39442](cilium/cilium#39442), [@pippolo84](https://github.com/pippolo84)) - **↪️ Multi-Pool Tunnel Routing**: Add support for tunnel routing in multi-pool IPAM mode ([cilium/cilium#38483](cilium/cilium#38483), [@pippolo84](https://github.com/pippolo84)) #### 🛣️ BGP - **📇 Route Aggregation**: Add support for BGP route aggregation in the control plane ([cilium/cilium#37275](cilium/cilium#37275), [@romanspb80](https://github.com/romanspb80)) - **🎯 Overlapping Selector Matches**: Support overlapping selector matches in **CiliumBGPAdvertisement** resources ([cilium/cilium#36414](cilium/cilium#36414), [@dswaffordcw](https://github.com/dswaffordcw)) - **🆔 New Router ID generation modes**: Generate router-id based on MAC addresses, or from an IP address pool ([cilium/cilium#36451](cilium/cilium#36451), [@yushoyamaguchi](https://github.com/yushoyamaguchi); [cilium/cilium#38300](cilium/cilium#38300), [@liyihuang](https://github.com/liyihuang)) #### 🧑‍💻 Development Experience - **🧪 Test attribution**: Identify owners of test in GitHub workflow results to make it easier to connect with other developers on tricky problems ([cilium/cilium#37027](cilium/cilium#37027), [@Joe](https://github.com/Joe) Stringer) - **🛏️ Policy REST API**: The Cilium policy API exposed over a local unix socket is deprecated. The other mechanisms to configure policy via Kubernetes resources or the local filesystem are preferred ([cilium/cilium#40212](cilium/cilium#40212), [@squeed](https://github.com/squeed)) - **🏗️ Feature Deprecation**: Deprecate underused features like Custom Calls, Recorder API and External Workloads ([cilium/cilium#38480](cilium/cilium#38480), [cilium/cilium#39642](cilium/cilium#39642), [cilium/cilium#37418](cilium/cilium#37418), [@brb](https://github.com/brb)) #### 🏢 Community - **❤️ Production Case Studies**: Many end-users have stepped forward to tell their stories running Cilium in production. If your company wants to submit their case studies let us know. We would love to hear your feedback! - [ByteDance](https://www.youtube.com/watch?v=cKPW67D7X10), [Canopus Networks](https://www.youtube.com/watch?v=YXl9xuIxylY), [Corner Banca](https://www.youtube.com/watch?v=HVPKSefazl4), [DB Schenker](https://www.cncf.io/case-studies/db-schenker/), [eBay](https://www.youtube.com/watch?v=xEa4KFf5FzY), [ECCO](https://www.cncf.io/case-studies/ecco/), [G-Research](https://www.youtube.com/watch?v=kjSFN34dROQ), [Social Network Company](https://cilium.io/blog/2025/04/15/tetragon-social-networking-user-story/), and [Preferred Networks](https://www.youtube.com/watch?v=n7_I4zu6f_M) - **🇬🇧 London Events**: The community gathered at [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-europe/co-located-events/ciliumcon/) and the [Cilium Developer Summit](https://github.com/cilium/dev-summits/tree/main/2025-EU) in London - **🇺🇸 Atlanta Events**: Meet us at the upcoming [CiliumCon](https://events.linuxfoundation.org/kubecon-cloudnativecon-north-america/co-located-events/ciliumcon/) and Cilium Developers Summit in Atlanta, Georgia - **👥 SIG Community Meetings**: [SIG Community](https://github.com/cilium/community/tree/main/sig-community) now meets every first and third Thursday to foster, grow, and sustain the Cilium open source community #### 📔 Full CHANGELOG - Full CHANGELOG.md can be found [here](https://github.com/cilium/cilium/blob/v1.18.0/CHANGELOG.md). And finally, we would like to thank you to all contributors of Cilium that helped directly and indirectly with the project. The success of Cilium could not happen without all of you. ❤️ :people\_holding\_hands: ❤️ </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://gitea.alexlebens.dev/alexlebens/infrastructure/pulls/1062 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]>

maintainer-s-little-helper bot added the dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. label Mar 29, 2025

MrFreezeex force-pushed the mirror-endpointslices branch 8 times, most recently from ac95085 to dc930fa Compare March 30, 2025 16:15

MrFreezeex force-pushed the mirror-endpointslices branch from dc930fa to c4ce5e6 Compare March 30, 2025 17:07

MrFreezeex force-pushed the mirror-endpointslices branch from c4ce5e6 to 0d29674 Compare March 30, 2025 17:15

MrFreezeex marked this pull request as ready for review March 30, 2025 19:41

MrFreezeex requested a review from a team as a code owner March 30, 2025 19:41

MrFreezeex requested a review from giorio94 March 30, 2025 19:41

giorio94 added release-note/minor This PR changes functionality that users may find relevant to operating Cilium. area/clustermesh Relates to multi-cluster routing functionality in Cilium. labels Apr 4, 2025

maintainer-s-little-helper bot removed dont-merge/needs-release-note-label The author needs to describe the release impact of these changes. labels Apr 4, 2025

giorio94 added the kind/feature This introduces new functionality. label Apr 4, 2025

giorio94 reviewed Apr 7, 2025

View reviewed changes

MrFreezeex force-pushed the mirror-endpointslices branch from 0d29674 to 2125446 Compare April 7, 2025 15:32

MrFreezeex force-pushed the mirror-endpointslices branch 3 times, most recently from fbaac23 to b08623f Compare April 28, 2025 21:45

MrFreezeex force-pushed the mirror-endpointslices branch from 30d2010 to d627172 Compare May 14, 2025 19:38

MrFreezeex requested a review from giorio94 May 14, 2025 20:13

giorio94 approved these changes May 19, 2025

View reviewed changes

pkg/clustermesh/mcsapi/endpointslice_mirror_controller.go Outdated Show resolved Hide resolved

MrFreezeex force-pushed the mirror-endpointslices branch from d627172 to 7e1afbb Compare May 19, 2025 11:38

MrFreezeex requested review from a team as code owners May 19, 2025 11:38

MrFreezeex requested review from gandro and tommyp1ckles May 19, 2025 11:38

MrFreezeex force-pushed the mirror-endpointslices branch from 7e1afbb to 0e8b38d Compare May 19, 2025 11:41

MrFreezeex added 2 commits May 19, 2025 13:42

clustermesh: handle tricky case in the endpointslice mirror controller

b1a83a6

This commit attempt to recover nicely on tricky cases where the service name label is remove from EndpointSlice. Signed-off-by: Arthur Outhenin-Chalandre <[email protected]>

MrFreezeex force-pushed the mirror-endpointslices branch from 0e8b38d to b1a83a6 Compare May 19, 2025 11:42

giorio94 enabled auto-merge May 19, 2025 12:01

gandro approved these changes May 20, 2025

View reviewed changes

giorio94 added this pull request to the merge queue May 20, 2025

Merged via the queue into cilium:main with commit e1b9e0d May 20, 2025
67 checks passed

Conversation

MrFreezeex commented Mar 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MrFreezeex commented Mar 30, 2025

Uh oh!

MrFreezeex commented Mar 30, 2025

Uh oh!

MrFreezeex commented Mar 30, 2025

Uh oh!

giorio94 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

MrFreezeex commented Apr 7, 2025

Uh oh!

giorio94 commented Apr 7, 2025

Uh oh!

MrFreezeex commented Apr 28, 2025

Uh oh!

giorio94 commented May 19, 2025

Uh oh!

giorio94 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

giorio94 commented May 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MrFreezeex commented May 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

MrFreezeex commented May 19, 2025

Uh oh!

MrFreezeex commented May 19, 2025

Uh oh!

MrFreezeex commented May 19, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

MrFreezeex commented Mar 29, 2025 •

edited

Loading

giorio94 commented May 19, 2025 •

edited

Loading

MrFreezeex commented May 19, 2025 •

edited

Loading