unkin/kea-operator
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Stop KeaCluster reconcile hot-loop #10

Merged
benvin merged 3 commits from benvin/fix-reconcile-hotloop into main 2026-10-05 23:53:46 +11:00
Conversation 2 Commits 3 Files Changed 6
+193 -134
unkin-agent commented 2026-10-05 22:15:21 +11:00
Member
Copy Link
Copy Source

KeaCluster reconciles hot-looped: the LB Service annotations were replaced wholesale, fighting Rancher's field.cattle.io/publicEndpoints, and every reconcile triggered a ctrl-agent config-reload.

  • merge Service labels/annotations instead of replacing them
  • track operator-owned annotations in kea.unkin.net/managed-annotations and remove ones dropped from the spec
  • keep allocated NodePorts and set TargetPort explicitly so steady-state reconciles write nothing
  • remove the config-reload path; config reaches pods via the initContainer copy and a pod-template hash roll
  • drop the unused pods grant from kind RBAC
KeaCluster reconciles hot-looped: the LB Service annotations were replaced wholesale, fighting Rancher's `field.cattle.io/publicEndpoints`, and every reconcile triggered a ctrl-agent config-reload. - merge Service labels/annotations instead of replacing them - track operator-owned annotations in `kea.unkin.net/managed-annotations` and remove ones dropped from the spec - keep allocated NodePorts and set TargetPort explicitly so steady-state reconciles write nothing - remove the config-reload path; config reaches pods via the initContainer copy and a pod-template hash roll - drop the unused pods grant from kind RBAC
unkin-agent added 1 commit 2026-10-05 22:15:21 +11:00
Stop KeaCluster reconcile hot-loop
ci/woodpecker/pr/test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/build Pipeline was successful
Details
682b6b64be 
Merge Service labels/annotations instead of replacing them, keep allocated
NodePorts and set TargetPort so steady-state reconciles are no-ops, and drop
the per-reconcile config-reload (running pods never see new config; a config
change rolls the StatefulSet).
unkin-agent commented 2026-10-05 22:19:43 +11:00
Author
Member
Copy Link
Copy Source
  • internal/controller/keacluster_controller.go:242 — mergeInto(svc.Annotations, mergeAnnotations(...)) never removes keys the operator set earlier, so dropping an entry from spec.service.annotations or clearing ipAddressPool leaves a stale annotation (e.g. purelb.io/service-group) forever → record the operator-owned keys (e.g. in a kea.unkin.net/managed-annotations annotation) and delete those absent from the spec, plus a test for removal.
  • nit: hack/kind/manifests/rbac.yaml:18 — still grants pods get/list/watch, which only the removed config-reload path used → drop it with the generated role.
- internal/controller/keacluster_controller.go:242 — `mergeInto(svc.Annotations, mergeAnnotations(...))` never removes keys the operator set earlier, so dropping an entry from `spec.service.annotations` or clearing `ipAddressPool` leaves a stale annotation (e.g. `purelb.io/service-group`) forever → record the operator-owned keys (e.g. in a `kea.unkin.net/managed-annotations` annotation) and delete those absent from the spec, plus a test for removal. - nit: hack/kind/manifests/rbac.yaml:18 — still grants `pods get/list/watch`, which only the removed config-reload path used → drop it with the generated role.
unkin-agent added 2 commits 2026-10-05 22:21:02 +11:00
Remove stale operator-owned Service annotations 703eeb0eed
Drop unused pods grant from kind RBAC
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/test Pipeline was successful
Details
ci/woodpecker/pr/build Pipeline was successful
Details
ab0f810c07
unkin-agent commented 2026-10-05 22:22:50 +11:00
Author
Member
Copy Link
Copy Source

No findings.

No findings.
benvin merged commit bca44e3be1 into main 2026-10-05 23:53:46 +11:00
benvin deleted branch benvin/fix-reconcile-hotloop 2026-10-05 23:53:46 +11:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/kea-operator#10
Delete Branch "benvin/fix-reconcile-hotloop"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?