Repository navigation
net: skip no-op managed kube-proxy reconciliation - #914
Merged
Merged
Conversation
Patrick W. Healy (phealy)
added this pull request to stack #919
October 14, 2026 23:10
Patrick W. Healy (phealy)
changed the title
This was referenced Oct 14, 2026
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Event filtering can miss same-name DaemonSet replacements, leaving managed drift or provider coverage unreconciled.
1 open finding
What changed in this PR
Reduces API server load by avoiding unchanged managed kube-proxy writes in the network controller.
Changes:
- Compares cached and live DaemonSets with normalized server defaults before writing.
- Filters DaemonSet and Site events to reduce unnecessary reconciliation.
- Adds regression tests and documents the reconciliation behavior.
| File | Description |
|---|---|
| internal/net/controller/kubeproxy_controller.go | Adds no-op detection, default normalization, and event filtering. |
| internal/net/controller/kubeproxy_controller_test.go | Tests reconciliation, drift repair, errors, and event relevance. |
| designs/managed-kube-proxy.md | Documents cache-first comparison and live verification. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Patrick W. Healy (phealy)
marked this pull request as ready for review
October 16, 2026 23:50
Patrick W. Healy (phealy)
force-pushed
the
phealy/net-api-controller-noops
branch
from
October 21, 2026 18:52
ebb0cb5 to
6754f0e
Compare
Cameron Childress (cchildress)
previously approved these changes
Oct 21, 2026
Patrick W. Healy (phealy)
force-pushed
the
phealy/net-api-controller-noops
branch
from
October 23, 2026 21:00
6754f0e to
b497d1b
Compare
Use informer cache comparisons and normalized server defaults to avoid no-op API writes, while narrowing DaemonSet and Site event requeues. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ab9b78ee-42b8-4841-8d74-cd78d002d48b
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ab9b78ee-42b8-4841-8d74-cd78d002d48b
Generations are only comparable within one UID, so treat a same-name replacement observed as an update as relevant. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ab9b78ee-42b8-4841-8d74-cd78d002d48b
Reuse the controller fixture so reconciliation has both a fake client and the informer-backed lister required by the cache fast path. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 46ff6261-c4cc-4fb0-9fb7-4e66d2b9c203
Patrick W. Healy (phealy)
force-pushed
the
phealy/net-api-controller-noops
branch
from
October 23, 2026 21:02
b497d1b to
ff4e37b
Compare
Cameron Childress (cchildress)
approved these changes
Oct 23, 2026
Patrick W. Healy (phealy)
enabled stacked auto-merge
October 23, 2026 22:40
stacked auto-merge was automatically disabled
October 23, 2026 23:31
Auto-merge was disabled for another pull request in the stack
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stop the unbounded-net controller from writing managed kube-proxy objects that haven't changed.
enableServiceLinksdefault so a value the server filled in doesn't count as drift. A value someone actually disabled is still repaired.designs/managed-kube-proxy.mddescribes the new behavior.Testing
Unit tests cover:
Stack
This is one of five stacked PRs that reduce API server load from unbounded-net-controller and unbounded-net-node. Kubernetes remains the source of truth. Review them bottom to top:
Motivation. A large cluster running v0.8.0 had the controller continuously writing objects that hadn't changed. Every node agent also watched the whole cluster's gateway topology. On a canary cluster, the full stack cut controller API calls by 54.4% and node agent API calls by 73.8%.