Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
bridge, del: timeout after 55 secs of trying to list rules
Making sure the exec'ed nft command is executed in 55 secs allows for CNI to fail early, thus preventing CRI from sending another CNI DEL while the previous NFT call is still being processed. This fix prevents part of the behavior described in [0], in which: > cnv-bridge and nft comes pile up in a loop, increasing every 60, never completes The timeout had to be less than 60 seconds (otherwise CRI would still trigger CNI DEL again) but large enough for this feature to have a chance of working on older kernels (e.g. centOS 8), where it takes longer to access even a specific chain/table. Signed-off-by: Miguel Duarte Barroso <[email protected]>
- Loading branch information