From b413f2a5f82aa43570d6f671750b630c2f1cfcb3 Mon Sep 17 00:00:00 2001 From: Levalicious Date: Tue, 13 Oct 2026 14:40:32 -0400 Subject: [PATCH] lb: a failed pass blocks pod admission only where EgressServices exist With no EgressService and no member rules installed, an admission has nothing to protect or clean up, so a failing pass (a datapath bug, a bridge not yet addressed) answers "not a member" instead of stopping every pod on the node from starting. Wherever EgressServices exist, admission still fails closed. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01UHXzGrsxfkGk8LmwrBbHNZ --- lb/controller.go | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/lb/controller.go b/lb/controller.go index 31a00a19..bfcdf05f 100644 --- a/lb/controller.go +++ b/lb/controller.go @@ -389,6 +389,12 @@ func (c *Controller) admit(ctx context.Context, req admit.Request) (bool, int, e c.fetched[key] = pod } if err := c.sync(ctx); err != nil { + // with no EgressService and no member rules in place there is nothing to protect or to clean up for + // this IP: a broken pass must not stop every pod on the node from starting + if len(c.lastEgress.Members) == 0 && (c.egresses == nil || len(c.egresses.List()) == 0) { + common.Log.Warnf("lb: admitting %s/%s despite a failed pass (no EgressServices): %v", req.Namespace, req.Name, err) + return false, http.StatusOK, nil + } return false, http.StatusServiceUnavailable, err } for _, m := range c.lastEgress.Members {