[release-4.19] OCPBUGS-77442: Clear stale conntrack UDP entries for nodePorts by sunku5494 · Pull Request #3015 · openshift/ovn-kubernetes

sunku5494 · 2026-03-02T07:35:33Z

📑 Description

When an EndpointSlice for a UDP NodePort or loadbalancer type of service is updated, stale conntrack entries for removed endpoints must be flushed. The existing logic failed to do this correctly if the backend pod was on a different node. This patch fixes the issue by flushing conntrack entries by filtering the nodePort when the node is not hosting the backend pod.

In case that the backend pod was on the same node as the service, this issue won't happen. Since all old pod entries are removed from the node by the function deletePodConntrack when the pod is deleted.

(cherry picked from commit 46ce09a & 679442d)

This is a clean cherry pick.

Fixes #

Additional Information for reviewers

✅ Checks

My code requires changes to the documentation
if so, I have updated the documentation as required
My code requires tests
if so, I have added and/or updated the tests as required
All the tests have passed in the CI

How to verify it

When an EndpointSlice for a UDP NodePort or loadbalancer type of service is updated, stale conntrack entries for removed endpoints must be flushed. The existing logic failed to do this correctly if the backend pod was on a different node. This patch fixes the issue by flushing conntrack entries by filtering the nodePort when the node is not hosting the backend pod. In case that the backend pod was on the same node as the service, this issue won't happen. Since all old pod entries are removed from the node by the function deletePodConntrack when the pod is deleted. Signed-off-by: Peng Liu <pliu@redhat.com> (cherry picked from commit b426934) (cherry picked from commit 46ce09a) Signed-off-by: Venkata Charan Sunku <vsunku@redhat.com>

It should be able to preserve UDP traffic when server pod cycles for a NodePort service via a different node. Signed-off-by: Peng Liu <pliu@redhat.com> (cherry picked from commit 4e55026) (cherry picked from commit 679442d) Signed-off-by: Venkata Charan Sunku <vsunku@redhat.com>

openshift-ci-robot · 2026-03-02T07:35:40Z

@sunku5494: This pull request references Jira Issue OCPBUGS-77442, which is invalid:

release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
expected Jira Issue OCPBUGS-77442 to depend on a bug targeting a version in 4.20.0, 4.20.z and in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but no dependents were found

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

📑 Description

When an EndpointSlice for a UDP NodePort or loadbalancer type of service is updated, stale conntrack entries for removed endpoints must be flushed. The existing logic failed to do this correctly if the backend pod was on a different node. This patch fixes the issue by flushing conntrack entries by filtering the nodePort when the node is not hosting the backend pod.

In case that the backend pod was on the same node as the service, this issue won't happen. Since all old pod entries are removed from the node by the function deletePodConntrack when the pod is deleted.

(cherry picked from commit 46ce09a & 679442d)

This is a clean cherry pick.

Fixes #

Additional Information for reviewers

✅ Checks

My code requires changes to the documentation

if so, I have updated the documentation as required

My code requires tests

if so, I have added and/or updated the tests as required

All the tests have passed in the CI

How to verify it

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

sunku5494 · 2026-03-02T07:43:36Z

/jira refresh

openshift-ci-robot · 2026-03-02T07:43:40Z

@sunku5494: This pull request references Jira Issue OCPBUGS-77442, which is invalid:

expected dependent Jira Issue OCPBUGS-77357 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is ASSIGNED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

pliurh · 2026-03-02T08:41:32Z

/lgtm

sunku5494 · 2026-03-03T16:52:55Z

/retest-required

MrSanketkumar · 2026-03-04T05:37:39Z

/jira refresh

openshift-ci-robot · 2026-03-04T05:37:44Z

@MrSanketkumar: This pull request references Jira Issue OCPBUGS-77442, which is invalid:

expected dependent Jira Issue OCPBUGS-77357 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is POST instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

sunku5494 · 2026-03-04T05:48:00Z

/cc @MrSanketkumar

MrSanketkumar · 2026-03-04T06:28:24Z

Pre Merge verification is done for OCPBUGS-77442

/verified by @MrSanketkumar

openshift-ci-robot · 2026-03-04T06:28:36Z

@MrSanketkumar: This PR has been marked as verified by @MrSanketkumar.

Details

In response to this:

Pre Merge verification is done for OCPBUGS-77442

/verified by @MrSanketkumar

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

tssurya · 2026-03-05T12:38:57Z

/approve

tssurya · 2026-03-05T12:39:20Z

/label backport-risk-assessed

openshift-ci · 2026-03-05T12:39:48Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: pliurh, sunku5494, tssurya

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [tssurya]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

tssurya · 2026-03-05T12:58:20Z

/test e2e-aws-ovn-edge-zones

tssurya · 2026-03-05T13:07:07Z

/override ci/prow/e2e-aws-ovn-edge-zones
this was failing because of https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_ovn-[…]es-release-4.19-e2e-aws-ovn-edge-zones/2028894392663674880 ie openshift/release#75500
but then later now its failing due to install issues: https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_ovn-[…]es-release-4.19-e2e-aws-ovn-edge-zones/2028876480338989056
can't keep delaying this PR and failures are unrelated.

tssurya · 2026-03-05T13:07:21Z

/jira refresh

openshift-ci-robot · 2026-03-05T13:07:26Z

@tssurya: This pull request references Jira Issue OCPBUGS-77442, which is invalid:

expected dependent Jira Issue OCPBUGS-77357 to be in one of the following states: VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA), but it is MODIFIED instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-03-05T13:08:52Z

@tssurya: Overrode contexts on behalf of tssurya: ci/prow/e2e-aws-ovn-edge-zones

Details

In response to this:

/override ci/prow/e2e-aws-ovn-edge-zones
this was failing because of https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_ovn-[…]es-release-4.19-e2e-aws-ovn-edge-zones/2028894392663674880 ie openshift/release#75500
but then later now its failing due to install issues: https://prow.ci.openshift.org/view/gs/test-platform-results/pr-logs/pull/openshift_ovn-[…]es-release-4.19-e2e-aws-ovn-edge-zones/2028876480338989056
can't keep delaying this PR and failures are unrelated.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

sunku5494 · 2026-03-05T14:05:58Z

/jira refresh

openshift-ci-robot · 2026-03-05T14:06:08Z

@sunku5494: This pull request references Jira Issue OCPBUGS-77442, which is valid. The bug has been moved to the POST state.

7 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.19.z) matches configured target version for branch (4.19.z)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)
release note text is set and does not match the template
dependent bug Jira Issue OCPBUGS-77357 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
dependent Jira Issue OCPBUGS-77357 targets the "4.20.z" version, which is one of the valid target versions: 4.20.0, 4.20.z
bug has dependents

Requesting review from QA contact:
/cc @MrSanketkumar

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

sunku5494 · 2026-03-05T14:08:01Z

/tide refresh

sunku5494 · 2026-03-05T17:58:54Z

/test ci/prow/e2e-aws-ovn-hypershift
/test ci/prow/e2e-aws-ovn-windows

sunku5494 · 2026-03-05T18:00:05Z

/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-windows

sunku5494 · 2026-03-06T02:53:33Z

/retest-required

prabhapa · 2026-03-06T06:03:48Z

/override ci/prow/e2e-aws-ovn-edge-zones
Overriding as this is failing for unrelated issues and not related to PR changes . Also confirmed by @tssurya above.

openshift-ci · 2026-03-06T06:03:57Z

@prabhapa: Overrode contexts on behalf of prabhapa: ci/prow/e2e-aws-ovn-edge-zones

Details

In response to this:

/override ci/prow/e2e-aws-ovn-edge-zones
Overriding as this is failing for unrelated issues and not related to PR changes . Also confirmed by @tssurya above.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-03-06T06:03:59Z

@sunku5494: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/security	`021457f`	link	false	`/test security`
ci/prow/e2e-aws-ovn-edge-zones	`021457f`	link	true	`/test e2e-aws-ovn-edge-zones`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot · 2026-03-06T06:07:29Z

@sunku5494: Jira Issue Verification Checks: Jira Issue OCPBUGS-77442
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-77442 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

📑 Description

When an EndpointSlice for a UDP NodePort or loadbalancer type of service is updated, stale conntrack entries for removed endpoints must be flushed. The existing logic failed to do this correctly if the backend pod was on a different node. This patch fixes the issue by flushing conntrack entries by filtering the nodePort when the node is not hosting the backend pod.

In case that the backend pod was on the same node as the service, this issue won't happen. Since all old pod entries are removed from the node by the function deletePodConntrack when the pod is deleted.

(cherry picked from commit 46ce09a & 679442d)

This is a clean cherry pick.

Fixes #

Additional Information for reviewers

✅ Checks

My code requires changes to the documentation

if so, I have updated the documentation as required

My code requires tests

if so, I have added and/or updated the tests as required

All the tests have passed in the CI

How to verify it

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

pliurh added 2 commits February 27, 2026 20:06

openshift-ci Bot requested review from kyrtapz and martinkennelly March 2, 2026 07:36

openshift-ci Bot assigned pliurh Mar 2, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Mar 2, 2026

openshift-ci Bot requested a review from MrSanketkumar March 4, 2026 05:48

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 4, 2026

openshift-ci Bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Mar 5, 2026

openshift-ci Bot assigned anuragthehatter, asood-rh, barbora137, huiran0826, jechen0648 and meinali566 Mar 5, 2026

openshift-ci Bot assigned mffiedler, qiowang721 and rbbratta Mar 5, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 5, 2026

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Mar 5, 2026

openshift-merge-bot Bot merged commit 208e0c7 into openshift:release-4.19 Mar 6, 2026
27 of 28 checks passed

Conversation

sunku5494 commented Mar 2, 2026

📑 Description

Additional Information for reviewers

✅ Checks

How to verify it

Uh oh!

openshift-ci-robot commented Mar 2, 2026

📑 Description

Additional Information for reviewers

✅ Checks

How to verify it

Uh oh!

sunku5494 commented Mar 2, 2026

Uh oh!

openshift-ci-robot commented Mar 2, 2026

Uh oh!

pliurh commented Mar 2, 2026

Uh oh!

sunku5494 commented Mar 3, 2026

Uh oh!

MrSanketkumar commented Mar 4, 2026

Uh oh!

openshift-ci-robot commented Mar 4, 2026

Uh oh!

sunku5494 commented Mar 4, 2026

Uh oh!

MrSanketkumar commented Mar 4, 2026

Uh oh!

openshift-ci-robot commented Mar 4, 2026

Uh oh!

tssurya commented Mar 5, 2026

Uh oh!

tssurya commented Mar 5, 2026

Uh oh!

openshift-ci Bot commented Mar 5, 2026

Uh oh!

tssurya commented Mar 5, 2026

Uh oh!

tssurya commented Mar 5, 2026

Uh oh!

tssurya commented Mar 5, 2026

Uh oh!

openshift-ci-robot commented Mar 5, 2026

Uh oh!

openshift-ci Bot commented Mar 5, 2026

Uh oh!

sunku5494 commented Mar 5, 2026

Uh oh!

openshift-ci-robot commented Mar 5, 2026

Uh oh!

sunku5494 commented Mar 5, 2026

Uh oh!

sunku5494 commented Mar 5, 2026

Uh oh!

sunku5494 commented Mar 5, 2026

Uh oh!

sunku5494 commented Mar 6, 2026

Uh oh!

prabhapa commented Mar 6, 2026

Uh oh!

openshift-ci Bot commented Mar 6, 2026

Uh oh!

openshift-ci Bot commented Mar 6, 2026

Uh oh!

Uh oh!

openshift-ci-robot commented Mar 6, 2026

📑 Description

Additional Information for reviewers

✅ Checks

How to verify it

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

15 participants