mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-14 00:23:54 +09:00
Aleksei Sviridkin
436a19df1b
The split-horizon-routing-proof step ran two external-dns probes as bare Pods and polled them by fixed name. When the Cilium host-scope IPAM + Gateway API restore race (cilium/cilium#46799) hands a probe the per-node reserved:ingress IP, the sandbox is rejected with "IP already in use" and the e2e leak-healer deletes the wedged pod, expecting a controller to reschedule it. A bare Pod has no controller, so the delete was terminal: the probe vanished and the step failed polling a NotFound pod. Run the probes as Jobs so the pod is re-created on a fresh IP after the healer's delete, assert each Job reaches Complete instead of polling a fixed Pod name, and read the logs by job-name label. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
102 lines
3.1 KiB
YAML
102 lines
3.1 KiB
YAML
# external-dns probe SA/RBAC + two single-shot probe Jobs, each with a distinct
|
|
# --annotation-prefix (the upstream Split Horizon DNS pattern). external-dns
|
|
# 0.20 initialises its informer cache cluster-wide before applying --namespace,
|
|
# so the probe needs a ClusterRole, not a namespaced Role.
|
|
#
|
|
# The probes are Jobs, not bare Pods, on purpose. When the Cilium host-scope
|
|
# IPAM + Gateway API restore-window race hands a probe the per-node
|
|
# reserved:ingress IP (cilium/cilium#46799), the sandbox is rejected with
|
|
# "IP already in use" and the e2e leak-healer deletes the wedged pod, expecting
|
|
# a controller to reschedule it onto a free IP. A bare Pod has no controller, so
|
|
# that delete was terminal and the probe never returned; the Job re-creates it.
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: kuberture-e2e-edns-probe
|
|
namespace: cozy-kuberture
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: kuberture-e2e-edns-probe
|
|
rules:
|
|
- apiGroups: [""]
|
|
resources: ["services", "endpoints", "pods", "nodes", "namespaces"]
|
|
verbs: ["get", "list", "watch"]
|
|
- apiGroups: ["discovery.k8s.io"]
|
|
resources: ["endpointslices"]
|
|
verbs: ["get", "list", "watch"]
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: kuberture-e2e-edns-probe
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: kuberture-e2e-edns-probe
|
|
namespace: cozy-kuberture
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: kuberture-e2e-edns-probe
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: kuberture-e2e-edns-public
|
|
namespace: cozy-kuberture
|
|
spec:
|
|
backoffLimit: 6
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: kuberture-e2e-edns-probe
|
|
spec:
|
|
serviceAccountName: kuberture-e2e-edns-probe
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: edns
|
|
image: registry.k8s.io/external-dns/external-dns:v0.20.0
|
|
args:
|
|
- --source=service
|
|
- --namespace=cozy-kuberture
|
|
- --provider=inmemory
|
|
- --inmemory-zone=cozystack.test
|
|
- --registry=noop
|
|
- --once
|
|
- --interval=10s
|
|
- --annotation-prefix=external-dns.alpha.kubernetes.io/
|
|
- --domain-filter=cozystack.test
|
|
- --log-level=info
|
|
- --log-format=text
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: Job
|
|
metadata:
|
|
name: kuberture-e2e-edns-internal
|
|
namespace: cozy-kuberture
|
|
spec:
|
|
backoffLimit: 6
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: kuberture-e2e-edns-probe
|
|
spec:
|
|
serviceAccountName: kuberture-e2e-edns-probe
|
|
restartPolicy: Never
|
|
containers:
|
|
- name: edns
|
|
image: registry.k8s.io/external-dns/external-dns:v0.20.0
|
|
args:
|
|
- --source=service
|
|
- --namespace=cozy-kuberture
|
|
- --provider=inmemory
|
|
- --inmemory-zone=cozystack.test
|
|
- --registry=noop
|
|
- --once
|
|
- --interval=10s
|
|
- --annotation-prefix=kuberture-e2e-internal-dns.io/
|
|
- --domain-filter=cozystack.test
|
|
- --log-level=info
|
|
- --log-format=text
|