kubeovn / kube-ovn / 24762886302

26%

push

github

fix(lb): skip ct_flush on session-affinity UDP load balancers (#6671)

* fix(lb): skip ct_flush on session-affinity UDP load balancers

ct_flush wipes every conntrack entry on the LB's datapath whenever a
vip is mutated. The per-VPC session UDP LB is shared across every
service in the VPC, and SessionAffinity=ClientIP is carried in that
conntrack; enabling ct_flush there lets one service's backend churn
invalidate another service's active affinity and bounce subsequent
packets to a different backend.

Observed as a dual-stack k8s conformance flake where, during the
"session affinity: udp" test, a concurrent service in another
namespace updated its backends on cluster-udp-session-loadbalancer
mid-test, flushing the affinity state and landing try 2 on a different
pod than try 0.

Keep ct_flush=true for the non-session UDP LB (the original #6620
goal: no rolling-update blackholes) and keep it on per-DNAT UDP LBs
(those are not shared). Only the session UDP LB is excluded.

Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>

* test(init): assert exact variadic arity for CreateLoadBalancer

Copilot review on #6671 flagged that the regression test used a single
gomock.Any() for CreateLoadBalancer's variadic selectFields, which did
not match the production call's actual arity (0 args for non-session,
2 ip_src/ipv6_src args for session). Split the expectation to match
exactly so the test guards both call shapes precisely.

Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>

---------

Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

1 of 1 new or added line in 1 file covered. (100.0%)

14037 of 56572 relevant lines covered (24.81%)

0.29 hits per line