Conversation
gateway-bot
added
kind/fix
…removed from routing (#14222) Signed-off-by: Nick Nellis <[email protected]> Signed-off-by: David Jumani <[email protected]>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR backports a fix to ensure ServiceEntry clusters that select pod endpoints via workloadSelector respect Kubernetes pod readiness by excluding NotReady pods from generated EDS, aligning behavior with the EndpointSlice/Service path and enabling locality failover when local pods go NotReady.
Changes:
- Add a
Readyfield tokrtcollections.LocalityPod, include it in equality, and populate it from the pod’sReadycondition. - Filter NotReady pod-backed workloads in ServiceEntry endpoint generation, while explicitly treating WorkloadEntry/inline endpoints as always ready.
- Add/adjust tests and test fixtures to include pod readiness conditions.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| pkg/krtcollections/pods.go | Tracks pod readiness on LocalityPod and includes it in change detection. |
| pkg/kgateway/setup/testdata/setup_yaml/pods.yaml | Updates pod test fixtures to include a Ready=True condition. |
| pkg/kgateway/extensions2/plugins/serviceentry/endpoints.go | Skips NotReady pod-backed workloads when building ServiceEntry endpoints. |
| pkg/kgateway/extensions2/plugins/serviceentry/endpoints_test.go | Adds a unit test covering skipping NotReady pods (currently has a compile-breaking call signature). |
| pkg/kgateway/extensions2/plugins/serviceentry/collections.go | Marks WorkloadEntry/inline workloads as Ready=true so they are not filtered. |
Comment on lines
+48
to
+53
| weWorkload := selectedWorkloadFromEntry( | ||
| "cross-cluster", "server", | ||
| nil, nil, nil, | ||
| &networking.WorkloadEntry{Address: "10.0.0.3"}, | ||
| nil, | ||
| ) |
andy-fong
approved these changes
Jun 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
backport of #14222
Description
ServiceEntry clusters that select pod endpoints via
workloadSelectornow respect pod readiness: pod-backed endpoints whose KubernetesReadycondition is notTrueare excluded from the cluster's EDS, mirroring the EndpointSlice-based Service path. This lets locality failover promote endpoints in a peer cluster when all local pods for a selected workload go NotReady (e.g. during graceful termination, where kubelet flips the pod'sReadycondition toFalse).Scope:
workloadSelector-backed pod endpoints are affected.WorkloadEntryand inlineServiceEntryendpoints are treated as always Ready and are never filtered, since pod readiness does not apply to them (their health is managed by the remote/owning system).Change Type
/kind fix
Changelog