OCPBUGS-97951: add startup probes and DNS egress to network policies - #761
OCPBUGS-97951: add startup probes and DNS egress to network policies#761mkowalski wants to merge 1 commit into
Conversation
Add startupProbe to nmstate-webhook and nmstate-metrics containers to allow sufficient time for initialization before liveness/readiness probes begin checking. Without a startupProbe, pods that take longer than ~30s to start are killed by the liveness probe and enter CrashLoopBackOff. The startupProbe uses TCP socket checks with initialDelaySeconds=10, periodSeconds=10, and failureThreshold=18, giving containers up to 3 minutes to start. Once the startupProbe succeeds, regular liveness/readiness probes take over (no initialDelaySeconds needed since startup was already verified). Additionally, add DNS egress network policies (UDP/TCP 53) for webhook, metrics, and operator pods. The existing default-deny policies block all egress except TCP 6443 (API server), which prevents DNS resolution. While in-cluster API server access uses the KUBERNETES_SERVICE_HOST IP directly, various libraries may attempt DNS lookups during initialization, causing startup delays that compound with aggressive probe timing. Signed-off-by: Mateusz Kowalski <mko@redhat.com> Generated-by: AI Signed-off-by: Mateusz Kowalski <mko@redhat.com>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: mkowalski The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
mkowalski
changed the title
openshift-ci-robot
added
the
jira/valid-reference
|
@mkowalski: This pull request references Jira Issue OCPBUGS-97951, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/invalid-bug
|
/jira refresh |
|
@mkowalski: This pull request references Jira Issue OCPBUGS-97951, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/retest |
|
@mkowalski: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Backport of openshift/kubernetes-nmstate#759 to release-4.22.
See OCPBUGS-97951 / OCPBUGS-94072 for full description and analysis.
🤖 This PR was generated by AI on behalf of @mkowalski, who has reviewed it.