Index Kubernetes EndpointSlice by service name by kevinpollet · Pull Request #13395 · traefik/traefik

kevinpollet · 2026-06-24T08:53:45Z

What does this PR do?

Adds an informer indexer on discoveryv1.LabelServiceName and replaces the per-call EndpointSlices(ns).List(serviceSelector) label-selector scan with an indexed GetIndexer().ByIndex(...) lookup, across the ingress, crd, gateway, and ingress-nginx providers.

Motivation

The primary root-cause fix for #13011: the EndpointSlice migration in v3.1 (a8a92eb2a) replaced an O(1) Endpoints lookup with an O(N) scan of every EndpointSlice in the namespace on every loadService call, which dominates CPU during reconfig bursts.

Supercedes #13269

More

Added/updated tests
Added/updated documentation

Additional Notes

Co-authored-by: Piotr Maksymiuk [email protected]

Register an informer index on the kubernetes.io/service-name label and use it when resolving EndpointSlices for a Service. This avoids scanning all cached EndpointSlices for every backend lookup, which becomes expensive in clusters with many Services and routes. Assisted-by: Claude Opus 4.8 Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

rtribotte

LGTM

nandorKollar · 2026-06-25T16:18:55Z

FYI, to prove that the obvious, I created a quick benchmark with AI for this change, and there's a significant speedup too:

Slices   Before (ns/op)   After (ns/op)   Speedup
10       2,286            520             ~4.4x
100      6,668            1,613           ~4.1x
1000     53,854           13,350          ~4.0x

This should also manifest in drop in CPU usage.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [traefik](https://github.com/containous/traefik) | patch | `v3.7.5` → `v3.7.6` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/12) for more information. --- ### Release Notes <details> <summary>containous/traefik (traefik)</summary> ### [`v3.7.6`](https://github.com/containous/traefik/blob/HEAD/CHANGELOG.md#v376-2026-06-30) [Compare Source](traefik/traefik@v3.7.6...v3.7.6) [All Commits](traefik/traefik@v3.7.5...v3.7.6) **Bug fixes:** - **\[acme, logs]** Bump github.com/go-acme/lego/v5 ([#13154](traefik/traefik#13154) [@ldez](https://github.com/ldez)) - **\[acme]** Bump github.com/go-acme/lego/v5 ([#13359](traefik/traefik#13359) [@juliens](https://github.com/juliens)) - **\[k8s, k8s/ingress-nginx]** Fix ingress-nginx ssl passthrough status updates ([#13212](traefik/traefik#13212) [@nickmnt](https://github.com/nickmnt)) - **\[k8s/gatewayapi]** Add missing Gateway API features in conformance tests ([#13356](traefik/traefik#13356) [@AnatoleLucet](https://github.com/AnatoleLucet)) - **\[k8s/gatewayapi]** Avoid collisions for Gateway API services names ([#13367](traefik/traefik#13367) [@rtribotte](https://github.com/rtribotte)) - **\[k8s/gatewayapi]** Ignore other gateways parentRefs and update route parent statuses only for managed gateways ([#13397](traefik/traefik#13397) [@rtribotte](https://github.com/rtribotte)) - **\[k8s/ingress-nginx]** Configure retry according to buffering configuration ([#13039](traefik/traefik#13039) [@rtribotte](https://github.com/rtribotte)) - **\[k8s/ingress-nginx]** Fix force-ssl-redirect routing 418 when TLS is terminated upstream ([#13386](traefik/traefik#13386) [@carloslima](https://github.com/carloslima)) - **\[k8s]** Detect EndpointSlice condition changes ([#13405](traefik/traefik#13405) [@kevinpollet](https://github.com/kevinpollet)) - **\[k8s]** Index Kubernetes EndpointSlice by service name ([#13395](traefik/traefik#13395) [@kevinpollet](https://github.com/kevinpollet)) - **\[k8s]** Sort endpointslices to keep backend IPs consistent across rebuilds ([#13406](traefik/traefik#13406) [@kevinpollet](https://github.com/kevinpollet)) - **\[kv]** Bump kvtools/redis to v1.2.1 ([#13403](traefik/traefik#13403) [@ldez](https://github.com/ldez)) - **\[middleware, authentication]** Fix x-forwarded-port in forward-auth ([#13344](traefik/traefik#13344) [@juliens](https://github.com/juliens)) - **\[middleware, k8s/gatewayapi]** Fix Gateway API redirect missing statuses ([#13360](traefik/traefik#13360) [@AnatoleLucet](https://github.com/AnatoleLucet)) - **\[middleware, k8s/gatewayapi]** Fix Host header not being modified by RequestHeaderModifier ([#12805](traefik/traefik#12805) [@mihuross](https://github.com/mihuross)) - **\[middleware, k8s/gatewayapi]** Fix request scheme derivation when Gateway API RequestRedirect omits scheme ([#13347](traefik/traefik#13347) [@gndz07](https://github.com/gndz07)) - **\[middleware]** Fix CORS Max-Age set to 0 by default ([#13371](traefik/traefik#13371) [@AnatoleLucet](https://github.com/AnatoleLucet)) - **\[middleware]** Fix CORS wildcard when allow-credentials is true ([#13368](traefik/traefik#13368) [@AnatoleLucet](https://github.com/AnatoleLucet)) - **\[server]** Add an option to remove request headers with underscores ([#13262](traefik/traefik#13262) [@youkoulayley](https://github.com/youkoulayley)) - **\[server]** Configurable max request header size ([#13353](traefik/traefik#13353) [@juliens](https://github.com/juliens)) - **\[tls]** Fix nondeterministic TLS certificate selection on shared SAN ([#13348](traefik/traefik#13348) [@rtribotte](https://github.com/rtribotte)) - **\[webui]** Bump axios to v1.18.0 ([#13380](traefik/traefik#13380) [@gndz07](https://github.com/gndz07)) - **\[websocket]** Fix connection upgrades when backend server is using h2c scheme ([#12967](traefik/traefik#12967) [@stffabi](https://github.com/stffabi)) **Documentation:** - **\[k8s/crd]** Fix broken CRD reference links in IngressRoute page ([#13375](traefik/traefik#13375) [@s3onghyun](https://github.com/s3onghyun)) - **\[k8s/gatewayapi]** Remove experimental note for Gateway API/TLSRoute documentation ([#13392](traefik/traefik#13392) [@jnoordsij](https://github.com/jnoordsij)) - **\[k8s/ingress-nginx]** Add Kubernetes Ingress NGINX to the providers list ([#13372](traefik/traefik#13372) [@nmengin](https://github.com/nmengin)) - **\[k8s]** Align Helm chart documented values with chart v41 ([#13366](traefik/traefik#13366) [@mloiseleur](https://github.com/mloiseleur)) - **\[middleware, authentication, k8s/ingress-nginx]** Clarify intentional auth-response-headers gating and absence of stripping incoming X-Forwarded-\* headers ([#13342](traefik/traefik#13342) [@rtribotte](https://github.com/rtribotte)) - **\[middleware]** Clarify entryPoint middleware reference format ([#13364](traefik/traefik#13364) [@mloiseleur](https://github.com/mloiseleur)) - **\[security]** Add HTTP/2 header memory exhaustion security documentation ([#13381](traefik/traefik#13381) [@emilevauge](https://github.com/emilevauge)) - Adds documentations on maxHeaderBytes ([#13363](traefik/traefik#13363) [@juliens](https://github.com/juliens)) - Fix inaccuracies in reference documentation ([#13304](traefik/traefik#13304) [@sheddy-traefik](https://github.com/sheddy-traefik)) ### [`v3.7.6`](https://github.com/containous/traefik/blob/HEAD/CHANGELOG.md#v376-2026-06-30) [Compare Source](traefik/traefik@v3.7.5...v3.7.6) [All Commits](traefik/traefik@v3.7.5...v3.7.6) **Bug fixes:** - **\[acme, logs]** Bump github.com/go-acme/lego/v5 ([#13154](traefik/traefik#13154) [@ldez](https://github.com/ldez)) - **\[acme]** Bump github.com/go-acme/lego/v5 ([#13359](traefik/traefik#13359) [@juliens](https://github.com/juliens)) - **\[k8s, k8s/ingress-nginx]** Fix ingress-nginx ssl passthrough status updates ([#13212](traefik/traefik#13212) [@nickmnt](https://github.com/nickmnt)) - **\[k8s/gatewayapi]** Add missing Gateway API features in conformance tests ([#13356](traefik/traefik#13356) [@AnatoleLucet](https://github.com/AnatoleLucet)) - **\[k8s/gatewayapi]** Avoid collisions for Gateway API services names ([#13367](traefik/traefik#13367) [@rtribotte](https://github.com/rtribotte)) - **\[k8s/gatewayapi]** Ignore other gateways parentRefs and update route parent statuses only for managed gateways ([#13397](traefik/traefik#13397) [@rtribotte](https://github.com/rtribotte)) - **\[k8s/ingress-nginx]** Configure retry according to buffering configuration ([#13039](traefik/traefik#13039) [@rtribotte](https://github.com/rtribotte)) - **\[k8s/ingress-nginx]** Fix force-ssl-redirect routing 418 when TLS is terminated upstream ([#13386](traefik/traefik#13386) [@carloslima](https://github.com/carloslima)) - **\[k8s]** Detect EndpointSlice condition changes ([#13405](traefik/traefik#13405) [@kevinpollet](https://github.com/kevinpollet)) - **\[k8s]** Index Kubernetes EndpointSlice by service name ([#13395](traefik/traefik#13395) [@kevinpollet](https://github.com/kevinpollet)) - **\[k8s]** Sort endpointslices to keep backend IPs consistent across rebuilds ([#13406](traefik/traefik#13406) [@kevinpollet](https://github.com/kevinpollet)) - **\[kv]** Bump kvtools/redis to v1.2.1 ([#13403](traefik/traefik#13403) [@ldez](https://github.com/ldez)) - **\[middleware, authentication]** Fix x-forwarded-port in forward-auth ([#13344](traefik/traefik#13344) [@juliens](https://github.com/juliens)) - **\[middleware, k8s/gatewayapi]** Fix Gateway API redirect missing statuses ([#13360](traefik/traefik#13360) [@AnatoleLucet](https://github.com/AnatoleLucet)) - **\[middleware, k8s/gatewayapi]** Fix Host header not being modified by RequestHeaderModifier ([#12805](traefik/traefik#12805) [@mihuross](https://github.com/mihuross)) - **\[middleware, k8s/gatewayapi]** Fix request scheme derivation when Gateway API RequestRedirect omits scheme ([#13347](traefik/traefik#13347) [@gndz07](https://github.com/gndz07)) - **\[middleware]** Fix CORS Max-Age set to 0 by default ([#13371](traefik/traefik#13371) [@AnatoleLucet](https://github.com/AnatoleLucet)) - **\[middleware]** Fix CORS wildcard when allow-credentials is true ([#13368](traefik/traefik#13368) [@AnatoleLucet](https://github.com/AnatoleLucet)) - **\[server]** Add an option to remove request headers with underscores ([#13262](traefik/traefik#13262) [@youkoulayley](https://github.com/youkoulayley)) - **\[server]** Configurable max request header size ([#13353](traefik/traefik#13353) [@juliens](https://github.com/juliens)) - **\[tls]** Fix nondeterministic TLS certificate selection on shared SAN ([#13348](traefik/traefik#13348) [@rtribotte](https://github.com/rtribotte)) - **\[webui]** Bump axios to v1.18.0 ([#13380](traefik/traefik#13380) [@gndz07](https://github.com/gndz07)) - **\[websocket]** Fix connection upgrades when backend server is using h2c scheme ([#12967](traefik/traefik#12967) [@stffabi](https://github.com/stffabi)) **Documentation:** - **\[k8s/crd]** Fix broken CRD reference links in IngressRoute page ([#13375](traefik/traefik#13375) [@s3onghyun](https://github.com/s3onghyun)) - **\[k8s/gatewayapi]** Remove experimental note for Gateway API/TLSRoute documentation ([#13392](traefik/traefik#13392) [@jnoordsij](https://github.com/jnoordsij)) - **\[k8s/ingress-nginx]** Add Kubernetes Ingress NGINX to the providers list ([#13372](traefik/traefik#13372) [@nmengin](https://github.com/nmengin)) - **\[k8s]** Align Helm chart documented values with chart v41 ([#13366](traefik/traefik#13366) [@mloiseleur](https://github.com/mloiseleur)) - **\[middleware, authentication, k8s/ingress-nginx]** Clarify intentional auth-response-headers gating and absence of stripping incoming X-Forwarded-\* headers ([#13342](traefik/traefik#13342) [@rtribotte](https://github.com/rtribotte)) - **\[middleware]** Clarify entryPoint middleware reference format ([#13364](traefik/traefik#13364) [@mloiseleur](https://github.com/mloiseleur)) - **\[security]** Add HTTP/2 header memory exhaustion security documentation ([#13381](traefik/traefik#13381) [@emilevauge](https://github.com/emilevauge)) - Adds documentations on maxHeaderBytes ([#13363](traefik/traefik#13363) [@juliens](https://github.com/juliens)) - Fix inaccuracies in reference documentation ([#13304](traefik/traefik#13304) [@sheddy-traefik](https://github.com/sheddy-traefik)) </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.jfreudenberger.de/JuliusFreudenberger/nix-config/pulls/16 Co-authored-by: Renovate Bot <[email protected]> Co-committed-by: Renovate Bot <[email protected]>

ishioni and others added 2 commits June 24, 2026 10:48

review

94678cd

kevinpollet added this to the 3.6 milestone Jun 24, 2026

kevinpollet added status/2-needs-review kind/bug/fix a bug fix bot/light-review decreases the number of required LGTM from 3 to 1. area/provider/k8s labels Jun 24, 2026

traefiker added area/provider/k8s/ingress area/provider/k8s/crd area/provider/k8s/gatewayapi area/provider/k8s/ingress-nginx size/M labels Jun 24, 2026

kevinpollet removed area/provider/k8s/ingress area/provider/k8s/crd area/provider/k8s/gatewayapi area/provider/k8s/ingress-nginx labels Jun 24, 2026

kevinpollet mentioned this pull request Jun 24, 2026

kubernetes: index EndpointSlices by service name #13269

Closed

2 tasks

Merge branch 'v3.6' into endpointslice-index

98707dc

rtribotte approved these changes Jun 25, 2026

View reviewed changes

rtribotte added status/3-needs-merge and removed status/2-needs-review labels Jun 25, 2026

traefiker merged commit 43cad79 into traefik:v3.6 Jun 25, 2026
52 checks passed

traefiker removed status/3-needs-merge bot/light-review decreases the number of required LGTM from 3 to 1. labels Jun 25, 2026

github-actions Bot mentioned this pull request Jul 20, 2026

Update Helm release traefik to v41 claytono/infra#2606

Open

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Index Kubernetes EndpointSlice by service name#13395

Index Kubernetes EndpointSlice by service name#13395
traefiker merged 3 commits into
traefik:v3.6from
kevinpollet:endpointslice-index

kevinpollet commented Jun 24, 2026

Uh oh!

rtribotte left a comment

Uh oh!

Uh oh!

nandorKollar commented Jun 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Uh oh!

Conversation

kevinpollet commented Jun 24, 2026

What does this PR do?

Motivation

More

Additional Notes

Uh oh!

rtribotte left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

nandorKollar commented Jun 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants