[release-4.20] OCPBUGS-77357: Clear stale conntrack UDP entries for nodePorts by sunku5494 · Pull Request #3012 · openshift/ovn-kubernetes

sunku5494 · 2026-02-27T07:06:49Z

📑 Description

When an EndpointSlice for a UDP NodePort or loadbalancer type of service is updated, stale conntrack entries for removed endpoints must be flushed. The existing logic failed to do this correctly if the backend pod was on a different node. This patch fixes the issue by flushing conntrack entries by filtering the nodePort when the node is not hosting the backend pod.

In case that the backend pod was on the same node as the service, this issue won't happen. Since all old pod entries are removed from the node by the function deletePodConntrack when the pod is deleted.

This is a manual backport of commit b426934 by adapting DeleteConntrackServicePort calls to single return value and excluded a few changes in gateway_localnet_linux_test.go that dealt with "on update" test group that weren't present in release-4.20 and e2e test case commit 4e55026

Conflict resolution:

klog.V(5).Infof debug log line retained

Fixes #

Additional Information for reviewers

✅ Checks

My code requires changes to the documentation
if so, I have updated the documentation as required
My code requires tests
if so, I have added and/or updated the tests as required
All the tests have passed in the CI

How to verify it

openshift-ci-robot · 2026-02-27T07:06:56Z

@sunku5494: This pull request references Jira Issue OCPBUGS-77357, which is invalid:

release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
expected Jira Issue OCPBUGS-77357 to depend on a bug targeting a version in 4.21.0, 4.21.z and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

📑 Description

When an EndpointSlice for a UDP NodePort or loadbalancer type of service is updated, stale conntrack entries for removed endpoints must be flushed. The existing logic failed to do this correctly if the backend pod was on a different node. This patch fixes the issue by flushing conntrack entries by filtering the nodePort when the node is not hosting the backend pod.

In case that the backend pod was on the same node as the service, this issue won't happen. Since all old pod entries are removed from the node by the function deletePodConntrack when the pod is deleted.

This is a manual backport of commit b426934 by adapting DeleteConntrackServicePort calls to single return value and excluded a few test cases in gateway_localnet_linux_test.go that dealt with "on update" that weren't present in release-4.20 and e2e test case commit 4e55026

Conflict resolution:

klog.V(5).Infof debug log line retained

Fixes #

Additional Information for reviewers

✅ Checks

My code requires changes to the documentation

if so, I have updated the documentation as required

My code requires tests

if so, I have added and/or updated the tests as required

All the tests have passed in the CI

How to verify it

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

pliurh · 2026-02-27T07:35:11Z

/lgtm

When an EndpointSlice for a UDP NodePort or loadbalancer type of service is updated, stale conntrack entries for removed endpoints must be flushed. The existing logic failed to do this correctly if the backend pod was on a different node. This patch fixes the issue by flushing conntrack entries by filtering the nodePort when the node is not hosting the backend pod. In case that the backend pod was on the same node as the service, this issue won't happen. Since all old pod entries are removed from the node by the function deletePodConntrack when the pod is deleted. Signed-off-by: Peng Liu <pliu@redhat.com> (cherry picked from commit b426934) Signed-off-by: Venkata Charan Sunku <vsunku@redhat.com>

It should be able to preserve UDP traffic when server pod cycles for a NodePort service via a different node. Signed-off-by: Peng Liu <pliu@redhat.com> (cherry picked from commit 4e55026) Signed-off-by: Venkata Charan Sunku <vsunku@redhat.com>

sunku5494 · 2026-02-28T06:49:49Z

/retest-required

sunku5494 · 2026-03-02T02:03:36Z

/retest-required

pliurh · 2026-03-02T03:54:31Z

/lgtm

sunku5494 · 2026-03-02T11:29:20Z

/jira refresh

openshift-ci-robot · 2026-03-02T11:29:24Z

@sunku5494: This pull request references Jira Issue OCPBUGS-77357, which is invalid:

expected dependent Jira Issue OCPBUGS-77309 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is POST instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

sunku5494 · 2026-03-03T13:10:23Z

/retest-required

sunku5494 · 2026-03-03T14:51:54Z

/jira refresh

openshift-ci-robot · 2026-03-03T14:52:00Z

@sunku5494: This pull request references Jira Issue OCPBUGS-77357, which is invalid:

expected dependent Jira Issue OCPBUGS-77309 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ON_QA instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

sunku5494 · 2026-03-03T14:57:20Z

/jira refresh

openshift-ci-robot · 2026-03-03T14:57:33Z

@sunku5494: This pull request references Jira Issue OCPBUGS-77357, which is valid. The bug has been moved to the POST state.

7 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.20.z) matches configured target version for branch (4.20.z)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)
release note text is set and does not match the template
dependent bug Jira Issue OCPBUGS-77309 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
dependent Jira Issue OCPBUGS-77309 targets the "4.21.z" version, which is one of the valid target versions: 4.21.0, 4.21.z
bug has dependents

Requesting review from QA contact:
/cc @MrSanketkumar

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

sunku5494 · 2026-03-03T15:00:47Z

Pre Merge verification is done for OCPBUGS-77357

/verified by @MrSanketkumar

openshift-ci-robot · 2026-03-03T15:01:00Z

@sunku5494: This PR has been marked as verified by @MrSanketkumar.

Details

In response to this:

Pre Merge verification is done for OCPBUGS-77357

/verified by @MrSanketkumar

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-03-03T16:03:46Z

[APPROVALNOTIFIER] This PR is APPROVED

Approval requirements bypassed by manually added approval.

This pull-request has been approved by: pliurh, sunku5494

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

sdodson · 2026-03-03T19:57:04Z

/retest-required

sdodson · 2026-03-03T23:34:52Z

/retest-required

prabhapa · 2026-03-04T14:57:32Z

/override ci/prow/e2e-aws-ovn-edge-zones
/override ci/prow/qe-perfscale-payload-control-plane-6nodes
overriding as they have not to do with the changes and historically failing for most of the PRs.

openshift-ci · 2026-03-04T14:57:40Z

@prabhapa: Overrode contexts on behalf of prabhapa: ci/prow/e2e-aws-ovn-edge-zones, ci/prow/qe-perfscale-payload-control-plane-6nodes

Details

In response to this:

/override ci/prow/e2e-aws-ovn-edge-zones
/override ci/prow/qe-perfscale-payload-control-plane-6nodes
overriding as they have not to do with the changes and historically failing for most of the PRs.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

MrSanketkumar · 2026-03-04T18:26:32Z

/test e2e-aws-ovn-edge-zones

sunku5494 · 2026-03-05T02:47:53Z

/retest-required

prabhapa · 2026-03-05T05:32:24Z

/override ci/prow/e2e-aws-ovn-edge-zones
overriding as they have not to do with the PR changes and historically failing for most of the PRs.

openshift-ci · 2026-03-05T05:32:51Z

@prabhapa: Overrode contexts on behalf of prabhapa: ci/prow/e2e-aws-ovn-edge-zones

Details

In response to this:

/override ci/prow/e2e-aws-ovn-edge-zones
overriding as they have not to do with the PR changes and historically failing for most of the PRs.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

sunku5494 · 2026-03-05T07:17:54Z

/test e2e-gcp-ovn-techpreview

openshift-ci · 2026-03-05T10:28:38Z

@sunku5494: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/security	`679442d`	link	false	`/test security`
ci/prow/e2e-aws-ovn-edge-zones	`679442d`	link	true	`/test e2e-aws-ovn-edge-zones`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2026-03-05T10:32:47Z

@sunku5494: Jira Issue Verification Checks: Jira Issue OCPBUGS-77357
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-77357 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

📑 Description

When an EndpointSlice for a UDP NodePort or loadbalancer type of service is updated, stale conntrack entries for removed endpoints must be flushed. The existing logic failed to do this correctly if the backend pod was on a different node. This patch fixes the issue by flushing conntrack entries by filtering the nodePort when the node is not hosting the backend pod.

In case that the backend pod was on the same node as the service, this issue won't happen. Since all old pod entries are removed from the node by the function deletePodConntrack when the pod is deleted.

This is a manual backport of commit b426934 by adapting DeleteConntrackServicePort calls to single return value and excluded a few changes in gateway_localnet_linux_test.go that dealt with "on update" test group that weren't present in release-4.20 and e2e test case commit 4e55026

Conflict resolution:

klog.V(5).Infof debug log line retained

Fixes #

Additional Information for reviewers

✅ Checks

My code requires changes to the documentation

if so, I have updated the documentation as required

My code requires tests

if so, I have added and/or updated the tests as required

All the tests have passed in the CI

How to verify it

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

sunku5494 changed the title ~~[release-4.20] OCPBUGS-77357:~~ [release-4.20] OCPBUGS-77357: Clear stale conntrack UDP entries for nodePorts Feb 27, 2026

openshift-ci Bot requested review from jcaamano and tssurya February 27, 2026 07:07

openshift-ci Bot assigned pliurh Feb 27, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Feb 27, 2026

pliurh added 2 commits February 27, 2026 14:28

Add a e2e test for NodePort service

679442d

It should be able to preserve UDP traffic when server pod cycles for a NodePort service via a different node. Signed-off-by: Peng Liu <pliu@redhat.com> (cherry picked from commit 4e55026) Signed-off-by: Venkata Charan Sunku <vsunku@redhat.com>

sunku5494 force-pushed the OCPBUGS-77357 branch from 7588594 to 679442d Compare February 27, 2026 13:10

openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Feb 27, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Mar 2, 2026

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Mar 3, 2026

openshift-ci Bot requested a review from MrSanketkumar March 3, 2026 14:57

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 3, 2026

sdodson added approved Indicates a PR has been approved by an approver from all required OWNERS files. backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. labels Mar 3, 2026

openshift-ci Bot assigned anuragthehatter, asood-rh, barbora137, huiran0826, jechen0648, meinali566, mffiedler, qiowang721 and rbbratta Mar 3, 2026

openshift-merge-bot Bot merged commit e3dceb0 into openshift:release-4.20 Mar 5, 2026
28 of 29 checks passed

Conversation

sunku5494 commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📑 Description

Additional Information for reviewers

✅ Checks

How to verify it

Uh oh!

openshift-ci-robot commented Feb 27, 2026

📑 Description

Additional Information for reviewers

✅ Checks

How to verify it

Uh oh!

pliurh commented Feb 27, 2026

Uh oh!

sunku5494 commented Feb 28, 2026

Uh oh!

sunku5494 commented Mar 2, 2026

Uh oh!

pliurh commented Mar 2, 2026

Uh oh!

sunku5494 commented Mar 2, 2026

Uh oh!

openshift-ci-robot commented Mar 2, 2026

Uh oh!

sunku5494 commented Mar 3, 2026

Uh oh!

sunku5494 commented Mar 3, 2026

Uh oh!

openshift-ci-robot commented Mar 3, 2026

Uh oh!

sunku5494 commented Mar 3, 2026

Uh oh!

openshift-ci-robot commented Mar 3, 2026

Uh oh!

sunku5494 commented Mar 3, 2026

Uh oh!

openshift-ci-robot commented Mar 3, 2026

Uh oh!

openshift-ci Bot commented Mar 3, 2026

Uh oh!

sdodson commented Mar 3, 2026

Uh oh!

sdodson commented Mar 3, 2026

Uh oh!

prabhapa commented Mar 4, 2026

Uh oh!

openshift-ci Bot commented Mar 4, 2026

Uh oh!

MrSanketkumar commented Mar 4, 2026

Uh oh!

sunku5494 commented Mar 5, 2026

Uh oh!

prabhapa commented Mar 5, 2026

Uh oh!

openshift-ci Bot commented Mar 5, 2026

Uh oh!

sunku5494 commented Mar 5, 2026

Uh oh!

openshift-ci Bot commented Mar 5, 2026

Uh oh!

Uh oh!

openshift-ci-robot commented Mar 5, 2026

📑 Description

Additional Information for reviewers

✅ Checks

How to verify it

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

15 participants

sunku5494 commented Feb 27, 2026 •

edited

Loading