kubernetes: Exec timeout does not kick users out on kubectl client 1.21
What happened:
Exec-ing onto a pod does not kick you out.
What you expected to happen:
To get kicked out of the pod after the container runtime specified time is reached.
How to reproduce it (as minimally and precisely as possible):
- configure your kubectl client to 1.21
kubectl exec -it <any pod> -- sh
- wait however long your container runtime is set to and see that it doesn’t kick you out.
Anything else we need to know?:
Environment:
- Kubernetes version (use
kubectl version
):
$ k version
Client Version: version.Info{Major:"1", Minor:"21", GitVersion:"v1.21.1", GitCommit:"5e58841cce77d4bc13713ad2b91fa0d961e69192", GitTreeState:"clean", BuildDate:"2021-05-12T14:18:45Z", GoVersion:"go1.16.4", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"21", GitVersion:"v1.21.1+IKS", GitCommit:"04e16b9d6c7af21e462f7ac675c34b667cd6149e", GitTreeState:"clean", BuildDate:"2021-05-24T08:19:13Z", GoVersion:"go1.16.4", Compiler:"gc", Platform:"linux/amd64"}
- Cloud provider or hardware configuration:
- OS (e.g:
cat /etc/os-release
): - Kernel (e.g.
uname -a
): - Install tools:
- Network plugin and version (if this is a network-related bug):
- Others: We’re using containerd 1.5.2 and konnectivity 0.19
/sig cli
About this issue
- Original URL
- State: open
- Created 3 years ago
- Reactions: 1
- Comments: 29 (14 by maintainers)
it is the SPDY ping https://github.com/containerd/containerd/issues/5563#issuecomment-861038759
This is a problem of when a bug becomes a feature, the spdy library conflated the ping control frames with the data frame, so the pings account as part of the session, renewing it and never reaching the timeout. Ping control frames should not be considered for the stream timeout, however, it is not possible to fix that in a backwards compatible way, and my suggestion to add a new timeout based on session activity was discarded … maybe now that we are moving from spdy to websockets we can fix it, but as today there is no more chances than disabling spdy pings