Integration with other Cilium features

Oct 13, 2025 by wbrum.org 3 views

Introduction

Cilium is a modern networking and security solution for Kubernetes that provides a robust and scalable way to manage network policies and security groups. However, in certain scenarios, the Cilium operator may experience issues acquiring the lease lock, leading to errors and timeouts. In this CFP, we propose an option to configure the timeout for lease lock acquisition in the Cilium operator, allowing administrators to increase the timeout period if necessary.

Problem Statement

When running a Kubernetes cluster with a remote control plane in a region different from the worker nodes, the Cilium operator may experience difficulties acquiring the lease lock within the default timeout period of 5 seconds. This can lead to errors and timeouts, as seen in the following log snippet:

level=error msg="error retrieving resource lock kube-system/cilium-operator-resource-lock: Get \"https://<api-server>:30071/apis/coordination.k8s.io/v1/namespaces/kube-system/leases/cilium-operator-resource-lock?timeout=5s\": net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)" subsys=klog

This issue can be particularly problematic in environments with high latency between the worker nodes and the control plane, where the default timeout period may not be sufficient to complete the lease lock acquisition.

Proposed Solution

To address this issue, we propose introducing a flag in the Cilium operator that allows configuring the timeout for acquiring the lease lock. This flag would enable administrators to increase the timeout period if necessary, ensuring that the Cilium operator can complete the lease lock acquisition even in environments with high latency.

Benefits

The proposed solution would provide several benefits, including:

Improved reliability: By allowing administrators to increase the timeout period, the Cilium operator would be more reliable and less prone to errors and timeouts.
Increased flexibility: The proposed solution would provide administrators with more flexibility in configuring the Cilium operator to meet the specific needs of their environment.
Better support for high-latency environments: The proposed solution would enable the Cilium operator to function effectively in environments with high latency between the worker nodes and the control plane.

Implementation

To implement the proposed solution, we would introduce a new flag in the Cilium operator that allows configuring the timeout for acquiring the lease lock. This flag would be added to the Cilium operator's configuration file, and would be used to set the timeout period for lease lock acquisition.

Example Use Case

Here is an example use case for the proposed solution:

Suppose we have a Kubernetes cluster with a remote control plane in a region different from the worker nodes. The Cilium operator is experiencing difficulties acquiring the lease lock within the default timeout period of 5 seconds, leading to errors and timeouts. To address this issue, we would introduce the new flag in the Cilium operator's configuration file, setting the timeout period for lease lock acquisition to 30 seconds. This would ensure that the Cilium operator can complete the lease lock acquisition even in environments with high latency.

Conclusion

In conclusion, the proposed solution would provide a reliable and flexible way to configure the timeout for lease lock acquisition in the Cilium operator. By introducing a new flag in the Cilium operator's configuration file, administrators would be able to increase the timeout period if necessary, ensuring that the Cilium operator can function effectively in environments with high latency.

Future Work

Future work on this proposal could include:

Testing and validation: Thorough testing and validation of the proposed solution to ensure that it functions as expected in various environments.
Documentation and support: Providing documentation and support for the new flag and its usage in the Cilium operator's configuration file.
Integration with other Cilium features: Integrating the proposed solution with other Cilium features, such as network policies and security groups, to provide a more comprehensive and robust networking and security solution for Kubernetes.

References

Acknowledgments

Introduction

In our previous article, we proposed an option to configure the timeout for lease lock acquisition in the Cilium operator. This feature would allow administrators to increase the timeout period if necessary, ensuring that the Cilium operator can function effectively in environments with high latency. In this Q&A article, we will address some of the most frequently asked questions about this proposal.

Q: What is the current timeout period for lease lock acquisition in the Cilium operator?

A: The current timeout period for lease lock acquisition in the Cilium operator is 5 seconds.

Q: Why is the current timeout period not sufficient in environments with high latency?

A: In environments with high latency between the worker nodes and the control plane, the default timeout period of 5 seconds may not be sufficient to complete the lease lock acquisition. This can lead to errors and timeouts, as seen in the following log snippet:

level=error msg="error retrieving resource lock kube-system/cilium-operator-resource-lock: Get \"https://<api-server>:30071/apis/coordination.k8s.io/v1/namespaces/kube-system/leases/cilium-operator-resource-lock?timeout=5s\": net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers)" subsys=klog

Q: How would the proposed solution address this issue?

A: The proposed solution would introduce a new flag in the Cilium operator's configuration file that allows configuring the timeout for acquiring the lease lock. This flag would enable administrators to increase the timeout period if necessary, ensuring that the Cilium operator can complete the lease lock acquisition even in environments with high latency.

Q: What are the benefits of the proposed solution?

A: The proposed solution would provide several benefits, including:

Improved reliability: By allowing administrators to increase the timeout period, the Cilium operator would be more reliable and less prone to errors and timeouts.
Increased flexibility: The proposed solution would provide administrators with more flexibility in configuring the Cilium operator to meet the specific needs of their environment.
Better support for high-latency environments: The proposed solution would enable the Cilium operator to function effectively in environments with high latency between the worker nodes and the control plane.

Q: How would the proposed solution be implemented?

A: To implement the proposed solution, we would introduce a new flag in the Cilium operator's configuration file that allows configuring the timeout for acquiring the lease lock. This flag would be added to the Cilium operator's configuration file, and would be used to set the timeout period for lease lock acquisition.

Q: What are the potential risks or challenges associated with the proposed solution?

A: The potential risks or challenges associated with the proposed solution include:

Increased latency: Increasing the timeout period may lead to increased latency in the Cilium operator, which could impact the overall performance of the cluster.
Complexity: The proposed solution may add complexity to the Cilium operator's configuration file, which could make it more difficult for administrators to manage and maintain.

Q: How would the proposed solution be tested and validated?

A: The proposed solution would be thoroughly tested and validated to ensure that it functions as expected in various environments. This would include testing the Cilium operator with different timeout periods, as well as testing the Cilium operator in environments with high latency.

Q: What is the expected timeline for implementing the proposed solution?

A: The expected timeline for implementing the proposed solution is dependent on the availability of resources and the priority of the feature. However, we anticipate that the proposed solution would be implemented within the next 6-12 months.