multus-cni icon indicating copy to clipboard operation
multus-cni copied to clipboard

improvement: Limit bootstrap pod list when building k8s client

Open gcampbell12 opened this issue 10 months ago • 0 comments

Currently when a new node is brought online for the first time multus lists every pod in the cluster (without caring about the data in the response) to confirm the client is working, in large clusters this can mean the API server is needlessly returning large amounts of data back to clients, this is even worse for clusters running things like batch compute that may bring online large numbers of nodes at the same time all making these requests in ~parallel adding pressure to the API server.

Instead we can atleast limit this request to the default namespace which should always exist as Kubernetes does not allow it to be deleted (https://github.com/kubernetes/kubernetes/blob/8d2a5a2c9c40e3c4e6aa2804cf167ea7fe169d55/staging/src/k8s.io/apiserver/pkg/admission/plugin/namespace/lifecycle/admission.go#L57) and since we don't care about the response returning an empty list (often no pods will run in the default namespace) is also fine.

Probably a better option would be to use a self subject access review here but I did not consider the changes required for RBAC to be worth while when this will reduce the impact of these initial calls vastly.

gcampbell12 avatar Jun 24 '25 18:06 gcampbell12