mirror of https://github.com/k3s-io/k3s
b01e6f68fe
Automatic merge from submit-queue hold namespaces briefly before processing deletion possible fix for #36891 in HA scenarios (either HA apiserver or HA etcd), it is possible for deletion of resources from namespace cleanup to race with creation of objects in the terminating namespace HA master timeline: 1. "delete namespace n" API call goes to apiserver 1, deletion timestamp is set in etcd 2. namespace controller observes namespace deletion, starts cleaning up resources, lists deployments 3. "create deployment d" API call goes to apiserver 2, gets persisted to etcd 4. apiserver 2 observes namespace deletion, stops allowing new objects to be created 5. namespace controller finishes deleting listed deployments, deletes namespace HA etcd timeline: 1. "create deployment d" API call goes to apiserver, gets persisted to etcd 2. "delete namespace n" API call goes to apiserver, deletion timestamp is set in etcd 3. namespace controller observes namespace deletion, starts cleaning up resources, lists deployments 4. list call goes to non-leader etcd member that hasn't observed the new deployment or the deleted namespace yet 5. namespace controller finishes deleting the listed deployments, deletes namespace In both cases, simply waiting to clean up the namespace (either for etcd members to observe objects created at the last second in the namespace, or for other apiservers to observe the namespace move to terminating phase and disallow additional creations) resolves the issue Possible other fixes: * do a second sweep of objects before deleting the namespace * have the namespace controller check for and clean up objects in namespaces that no longer exist * ...? |
||
|---|---|---|
| .. | ||
| certificates | ||
| cronjob | ||
| daemon | ||
| deployment | ||
| disruption | ||
| endpoint | ||
| garbagecollector | ||
| informers | ||
| job | ||
| namespace | ||
| node | ||
| petset | ||
| podautoscaler | ||
| podgc | ||
| replicaset | ||
| replication | ||
| resourcequota | ||
| route | ||
| service | ||
| serviceaccount | ||
| volume | ||
| .import-restrictions | ||
| BUILD | ||
| OWNERS | ||
| client_builder.go | ||
| controller_ref_manager.go | ||
| controller_utils.go | ||
| controller_utils_test.go | ||
| doc.go | ||
| lookup_cache.go | ||