Skip to content

Conversation

@MustafaSaber
Copy link
Member

This allows k8s dataclient to run without loading routing table (which won't call apisever), this will allow us to use k8s dataclient in webhook mode to enable some filters without calling apiserver and may allow us later to get redis endpoints wihout calling routeSRV.

This should replace #3722 which disable polling routing across all dataclients which maybe not desriable.

szuecs and others added 11 commits November 10, 2025 22:28
automate: pr label cw2025 for convenience

---------

Signed-off-by: Sandor Szücs <[email protected]>
…3716)

`TestPHCNoHealthyEndpoints` uses `random` for load balancing, and it's
possible some endpoints are never visited. A never visited endpoint
would have a drop probability of 0 (i.e., the endpoint is allowed to
pass the request). If we use `roundRobin`, we remove the uncertainty in
request distribution and we have a better exepectation on the metrics
count.

The detailed reasoning can also be found in:
#3189 (comment)

fix #3189

Signed-off-by: Max Qian <[email protected]>
fix #2713

In case of a slow network or limited network resource, the server may
shutdown before the Loopback() completes the roundtrip. Here, we use
Eventually() to wait for both server resolve the request (or fail
assertion on timeout) before continuing.

Signed-off-by: Max Qian <[email protected]>
ref #3706

Bumps
[docker/metadata-action](https://github.com/docker/metadata-action) from
5.8.0 to 5.9.0.
- [Release notes](https://github.com/docker/metadata-action/releases)
-
[Commits](docker/metadata-action@c1e5197...318604b)

---
updated-dependencies:
- dependency-name: docker/metadata-action dependency-version: 5.9.0
dependency-type: direct:production update-type:
version-update:semver-minor ...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…#3720)

ref: #3708

Bumps the all-go-mod-patch-and-minor group with 5 updates:

| Package | From | To |
| --- | --- | --- |
|
[github.com/envoyproxy/go-control-plane/envoy](https://github.com/envoyproxy/go-control-plane)
| `1.35.0` | `1.36.0` | |
[github.com/instana/go-sensor](https://github.com/instana/go-sensor) |
`1.71.1` | `1.71.2` | |
[github.com/testcontainers/testcontainers-go](https://github.com/testcontainers/testcontainers-go)
| `0.39.0` | `0.40.0` | |
[golang.org/x/oauth2](https://github.com/golang/oauth2) | `0.32.0` |
`0.33.0` | | [golang.org/x/sync](https://github.com/golang/sync) |
`0.17.0` | `0.18.0` |


Updates `github.com/envoyproxy/go-control-plane/envoy` from 1.35.0 to
1.36.0
- [Release
notes](https://github.com/envoyproxy/go-control-plane/releases)
-
[Changelog](https://github.com/envoyproxy/go-control-plane/blob/main/CHANGELOG.md)
-
[Commits](envoyproxy/go-control-plane@envoy/v1.35.0...envoy/v1.36.0)

Updates `github.com/instana/go-sensor` from 1.71.1 to 1.71.2
- [Release notes](https://github.com/instana/go-sensor/releases)
-
[Changelog](https://github.com/instana/go-sensor/blob/main/CHANGELOG.md)
-
[Commits](instana/go-sensor@v1.71.1...v1.71.2)

Updates `github.com/testcontainers/testcontainers-go` from 0.39.0 to
0.40.0
- [Release
notes](https://github.com/testcontainers/testcontainers-go/releases)
-
[Commits](testcontainers/testcontainers-go@v0.39.0...v0.40.0)

Updates `golang.org/x/oauth2` from 0.32.0 to 0.33.0
- [Commits](golang/oauth2@v0.32.0...v0.33.0)

Updates `golang.org/x/sync` from 0.17.0 to 0.18.0
- [Commits](golang/sync@v0.17.0...v0.18.0)

---
updated-dependencies:
- dependency-name: github.com/envoyproxy/go-control-plane/envoy
dependency-version: 1.36.0 dependency-type: direct:production
update-type: version-update:semver-minor dependency-group:
all-go-mod-patch-and-minor
- dependency-name: github.com/instana/go-sensor dependency-version:
1.71.2 dependency-type: direct:production update-type:
version-update:semver-patch dependency-group: all-go-mod-patch-and-minor
- dependency-name: github.com/testcontainers/testcontainers-go
dependency-version: 0.40.0 dependency-type: direct:production
update-type: version-update:semver-minor dependency-group:
all-go-mod-patch-and-minor
- dependency-name: golang.org/x/oauth2 dependency-version: 0.33.0
dependency-type: direct:production update-type:
version-update:semver-minor dependency-group: all-go-mod-patch-and-minor
- dependency-name: golang.org/x/sync dependency-version: 0.18.0
dependency-type: direct:production update-type:
version-update:semver-minor dependency-group: all-go-mod-patch-and-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…3717)

ref: #3709

Bumps amazonlinux from `8c22ec8` to `5ea3337`.

---
updated-dependencies:
- dependency-name: amazonlinux dependency-version: '2023'
dependency-type: direct:production update-type:
version-update:semver-patch ...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…3714)

replaces #3710

Bumps oss-fuzz-base/base-builder-go from `9e29308` to `9e76082`.

---
updated-dependencies:
- dependency-name: oss-fuzz-base/base-builder-go dependency-version:
9e76082f0d5e86f349c9f87f4e9bc994f905ba865160886ed121fe661e59d4aa
dependency-type: direct:production ...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
ref #3707

Bumps
[docker/setup-qemu-action](https://github.com/docker/setup-qemu-action)
from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
-
[Commits](docker/setup-qemu-action@2910929...c7c5346)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action dependency-version: 3.7.0
dependency-type: direct:production update-type:
version-update:semver-minor ...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
- register missed drop response cookie

Signed-off-by: Veronika Volokitina <[email protected]>
The core problem was that we have had a non-seeded global random source
that generated every time different random numbers so it's easy to have
bad luck. Another issue was that if you have a global random source is
that the different test cases interfere with each other. The third
problem was that we used the same global random to have randomized
response codes on the server side in the httptest.Server.
All of it is now fixed. 

We have an option to use a static seeded random source by filter that we
use for tests.
In general we use the global random source that we have to guard by a
mutex at least `test -race` says so.
Maybe we should also create filter local random source for the
production build but I think it's fine like this.

Signed-off-by: Sandor Szücs <[email protected]>
- registered missed awsSigv4

Signed-off-by: Veronika Volokitina <[email protected]>
@MustafaSaber MustafaSaber added the major moderate risk, for example new API, small filter changes that have no risk like refactoring or logs label Nov 12, 2025
@zalando-robot
Copy link

Deployment Checklist

This change falls under the deployment policy.

💁 Since Nov 10th, we are in the RED deployment zone. This means all changes released to production must adhere to the following requirements:

  • Detailed release notes are provided in this PR’s description.
  • Thorough load-testing has been performed, and is documented in the description/comment.
  • You can enable/disable the change via feature toggles, and have confirmed these toggles work as expected.
  • Technical review: A Principal Engineer, Engineering Manager or Head of Engineering have green-lit your changes, and the reviewer is named in the description/comments.
  • Application Owner (Director+) approval is given about the PR, and the approver is named in the description/comments.

👉 Regardless of which boxes you click in this comment, merge/deployment will not be blocked.
Reports about deployment policy adherence will be circulated daily.

This allows k8s dataclient to run without loading routing table (which won't call apisever), this will
allow us to use k8s dataclient in webhook mode to enable some filters without calling apiserver and may
allow us later to get redis endpoints wihout calling routeSRV.

This should replace #3722 which disable polling routing across all dataclients
which maybe not desriable.

Signed-off-by: Mustafa Abdelrahman <[email protected]>
@MustafaSaber MustafaSaber force-pushed the block-k8s-routings-obj-poll branch from 63a245f to 98e86ee Compare November 12, 2025 13:59
// instead using Kubernetes Services.
KubernetesForceService bool

// KubernetesNoPoll force kubernetes dataclient to not create routing table
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dataclient doesn't create a routing table.
It just creates []*eskip.Routes.
So a list of route descriptions

KubernetesBackendTrafficAlgorithm kubernetes.BackendTrafficAlgorithm `yaml:"-"`
KubernetesDefaultLoadBalancerAlgorithm string `yaml:"kubernetes-default-lb-algorithm"`
KubernetesForceService bool `yaml:"kubernetes-force-service"`
KubernetesNoPoll bool `yaml:"kubernetes-no-poll"`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe better an enum to create a DisableDataClient or something like that.
I think we should not be as specific if we introduce a new configuration.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's also a nice idea, thanks!

@vlktna
Copy link
Member

vlktna commented Nov 13, 2025

disabled routing table updates by setting the source-poll-timeout flag to the max int64 value

zalando-incubator/kubernetes-on-aws#10181

@szuecs szuecs force-pushed the cw2025 branch 2 times, most recently from e298dd4 to 264ca18 Compare December 2, 2025 16:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

major moderate risk, for example new API, small filter changes that have no risk like refactoring or logs

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants