Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[nftables] Limit concurrent set reads #8996

Merged

Conversation

caseydavenport
Copy link
Member

@caseydavenport caseydavenport commented Jul 8, 2024

Description

Avoid thousands of concurrent nftables set queries.

Related issues/PRs

Todos

  • Tests
  • Documentation
  • Release note

Release Note

TBD

Reminder for the reviewer

Make sure that this PR has the correct labels and milestone set.

Every PR needs one docs-* label.

  • docs-pr-required: This change requires a change to the documentation that has not been completed yet.
  • docs-completed: This change has all necessary documentation completed.
  • docs-not-required: This change has no user-facing impact and requires no docs.

Every PR needs one release-note-* label.

  • release-note-required: This PR has user-facing changes. Most PRs should have this label.
  • release-note-not-required: This PR has no user-facing changes.

Other optional labels:

  • cherry-pick-candidate: This PR should be cherry-picked to an earlier release. For bug fixes only.
  • needs-operator-pr: This PR is related to install and requires a corresponding change to the operator.

@caseydavenport caseydavenport requested a review from a team as a code owner July 8, 2024 21:27
@marvin-tigera marvin-tigera added this to the Calico v3.29.0 milestone Jul 8, 2024
@marvin-tigera marvin-tigera added release-note-required Change has user-facing impact (no matter how small) docs-pr-required Change is not yet documented labels Jul 8, 2024
@caseydavenport caseydavenport added docs-not-required Docs not required for this change release-note-not-required Change has no user-facing impact labels Jul 8, 2024
@marvin-tigera marvin-tigera removed release-note-required Change has user-facing impact (no matter how small) docs-pr-required Change is not yet documented labels Jul 8, 2024
@caseydavenport caseydavenport changed the title Limit to 100 concurrent set reads [nftables] Limit to 100 concurrent set reads Jul 8, 2024
felix/nftables/ipsets.go Outdated Show resolved Hide resolved
felix/nftables/ipsets.go Show resolved Hide resolved
felix/nftables/ipsets.go Show resolved Hide resolved
@caseydavenport
Copy link
Member Author

@fasaxc thanks for the quick review! I think this is ready for another look

Copy link
Member

@fasaxc fasaxc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Would be good to have a UT that checks the error path that had a bug?

@caseydavenport caseydavenport changed the title [nftables] Limit to 100 concurrent set reads [nftables] Limit concurrent set reads Jul 11, 2024
@caseydavenport
Copy link
Member Author

It's a little bit tricky to add a UT to really capture that without a larger code refactor - I'll keep looking.

I did add related UT that actually caught a different bug, so that's nice.

@caseydavenport caseydavenport merged commit 2aaa11d into projectcalico:master Jul 12, 2024
1 of 2 checks passed
@caseydavenport caseydavenport deleted the casey-max-concurrent-sets branch July 12, 2024 19:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
docs-not-required Docs not required for this change merge-when-ready release-note-not-required Change has no user-facing impact
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants