From 96ecb3aba015df62f95c750e980fd66c4ebf5c2a Mon Sep 17 00:00:00 2001 From: sudheernv Date: Tue, 10 Feb 2026 22:12:00 -0800 Subject: [PATCH] Fix CNI delete timer to start after acquiring IPAM lock Start the 90-second timeout after acquiring the lock in cmdDel, matching the pattern used in ADD operations. Previously, the timer started before lock acquisition, causing "context deadline exceeded" errors when DELETE operations waited in queue for the lock. --- cni-plugin/pkg/ipamplugin/ipam_plugin.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/cni-plugin/pkg/ipamplugin/ipam_plugin.go b/cni-plugin/pkg/ipamplugin/ipam_plugin.go index 67b5554da17..814d07680a2 100644 --- a/cni-plugin/pkg/ipamplugin/ipam_plugin.go +++ b/cni-plugin/pkg/ipamplugin/ipam_plugin.go @@ -434,9 +434,6 @@ func cmdDel(args *skel.CmdArgs) error { }) logger.Info("Releasing address using handleID") - ctx := context.Background() - ctx, cancel := context.WithTimeout(ctx, 90*time.Second) - defer cancel() // Acquire a best-effort host-wide lock to prevent multiple copies of the CNI plugin trying to assign/delete // concurrently. ReleaseXXX is concurrency safe already but serialising the CNI plugins means that @@ -445,6 +442,10 @@ func cmdDel(args *skel.CmdArgs) error { unlock := acquireIPAMLockBestEffort(conf.IPAMLockFile) defer unlock() + ctx := context.Background() + ctx, cancel := context.WithTimeout(ctx, 90*time.Second) + defer cancel() + if err := calicoClient.IPAM().ReleaseByHandle(ctx, handleID); err != nil { if _, ok := err.(errors.ErrorResourceDoesNotExist); !ok { logger.WithError(err).Error("Failed to release address")