From ec7c67a9ca9b950ca1f436c39a0cd7f9be8ac98a Mon Sep 17 00:00:00 2001 From: Rada Dimitrova <117522044+RadaBDimitrova@users.noreply.github.com> Date: Wed, 5 Aug 2026 09:43:14 +0300 Subject: [PATCH 1/4] [GEP-38] Reduce initial sizes for Seed and Shoot control plane `VictoriaLogs` PVCs (#15385) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * Reduce initial sizes for VictoriaLogs when pvc-autoscaler is enabled * Use VictoriaLogs annotation that ignores differences between CR and actual size of the PVC to suppress warnings While testing, I noticed the following: ``` │ {"level":"error","ts":"2026-07-28T07:25:13Z","logger":"controller-runtime.cache.UnhandledE │ │ rror","msg":"Failed to watch","reflector":"pkg/mod/k8s.io/client-go@v0.34.1/tools/cache/re │ │ flector.go:290","type":"*v1.StorageClass","error":"failed to list *v1.StorageClass: storag │ │ eclasses.storage.k8s.io is forbidden: User \"system:serviceaccount:garden:victoria-operato │ │ r\" cannot list resource \"storageclasses\" in API group \"storage.k8s.io\" at the cluster │ │ scope"} │ ``` and with @rrhubenov we decided on adding this annotation: operator.victoriametrics.com/pvc-allow-volume-expansion: "false" [to delegate control to an external tool for resizes](https://github.com/VictoriaMetrics/operator/issues/867) * Add clarifying comments * Change minStepAbsolute to 2Gi for victorialogs and address feedback --- pkg/apis/config/gardenlet/v1alpha1/types.go | 1 + .../logging/victorialogs/victorialogs.go | 11 ++++- .../logging/victorialogs/victorialogs_test.go | 7 ++- .../controller/seed/seed/components.go | 11 +++-- pkg/gardenlet/operation/botanist/logging.go | 11 ++++- .../operation/botanist/logging_test.go | 49 +++++++++++++++++++ 6 files changed, 83 insertions(+), 7 deletions(-) diff --git a/pkg/apis/config/gardenlet/v1alpha1/types.go b/pkg/apis/config/gardenlet/v1alpha1/types.go index df8f956035a0..8f4ed614539d 100644 --- a/pkg/apis/config/gardenlet/v1alpha1/types.go +++ b/pkg/apis/config/gardenlet/v1alpha1/types.go @@ -525,6 +525,7 @@ type VictoriaLogs struct { type GardenVictoriaLogs struct { // Storage is the disk storage capacity of VictoriaLogs. // Defaults to 100Gi. + // If pvc-autoscaler is enabled, this value is ignored and the initial size is set to 5Gi. // +optional Storage *resource.Quantity `json:"storage,omitempty" yaml:"storage,omitempty"` } diff --git a/pkg/component/observability/logging/victorialogs/victorialogs.go b/pkg/component/observability/logging/victorialogs/victorialogs.go index 5df0221a9e64..e11d2472be3b 100644 --- a/pkg/component/observability/logging/victorialogs/victorialogs.go +++ b/pkg/component/observability/logging/victorialogs/victorialogs.go @@ -183,6 +183,15 @@ func (v *victoriaLogs) vlSingle() *victoriametricsv1.VLSingle { }, }, }, + // This annotation tells the VictoriaMetrics operator not to attempt resizing the PVC itself, + // if the CR's storage field is mutated. PVC resizing is instead owned by the dedicated + // pvc-autoscaler component. If pvc-autoscaler gets disabled, the PVC will not be resized + // to the storage size specified in the VLSingle CR as long as this annotation is still present. + StorageMetadata: victoriametricsv1beta1.EmbeddedObjectMetadata{ + Annotations: map[string]string{ + "operator.victoriametrics.com/pvc-allow-volume-expansion": "false", + }, + }, ServiceSpec: &victoriametricsv1beta1.AdditionalServiceSpec{ EmbeddedObjectMetadata: victoriametricsv1beta1.EmbeddedObjectMetadata{ Name: constants.ServiceName, @@ -271,7 +280,7 @@ func (v *victoriaLogs) getPVCA(pvcAutoscaling PVCAutoscalingConfig) *pvcautoscal ScaleUp: &pvcautoscalerv1alpha1.ScalingRules{ UtilizationThresholdPercent: new(70), StepPercent: new(10), - MinStepAbsolute: new(resource.MustParse("1Gi")), + MinStepAbsolute: new(resource.MustParse("2Gi")), }, }, }, diff --git a/pkg/component/observability/logging/victorialogs/victorialogs_test.go b/pkg/component/observability/logging/victorialogs/victorialogs_test.go index e80320d7e0e4..c3e08b46740a 100644 --- a/pkg/component/observability/logging/victorialogs/victorialogs_test.go +++ b/pkg/component/observability/logging/victorialogs/victorialogs_test.go @@ -130,6 +130,11 @@ var _ = Describe("VictoriaLogs", func() { }, }, }, + StorageMetadata: victoriametricsv1beta1.EmbeddedObjectMetadata{ + Annotations: map[string]string{ + "operator.victoriametrics.com/pvc-allow-volume-expansion": "false", + }, + }, ServiceSpec: &victoriametricsv1beta1.AdditionalServiceSpec{ EmbeddedObjectMetadata: victoriametricsv1beta1.EmbeddedObjectMetadata{ Name: "logging-vl", @@ -554,7 +559,7 @@ func getPVCA(maxCapacity resource.Quantity) *pvcautoscalerv1alpha1.PersistentVol ScaleUp: &pvcautoscalerv1alpha1.ScalingRules{ UtilizationThresholdPercent: new(70), StepPercent: new(10), - MinStepAbsolute: new(resource.MustParse("1Gi")), + MinStepAbsolute: new(resource.MustParse("2Gi")), }, }, }, diff --git a/pkg/gardenlet/controller/seed/seed/components.go b/pkg/gardenlet/controller/seed/seed/components.go index 8d9caa290e9c..582f20d43b16 100644 --- a/pkg/gardenlet/controller/seed/seed/components.go +++ b/pkg/gardenlet/controller/seed/seed/components.go @@ -307,7 +307,7 @@ func (r *Reconciler) instantiateComponents( if err != nil { return } - c.victoriaLogs, err = r.newVictoriaLogs(seed.GetInfo().Spec.Settings) + c.victoriaLogs, err = r.newVictoriaLogs(seed) if err != nil { return } @@ -625,12 +625,17 @@ func (r *Reconciler) newVali(seed *seedpkg.Seed, istioIngressGatewayLabels map[s return deployer, err } -func (r *Reconciler) newVictoriaLogs(seedSettings *gardencorev1beta1.SeedSettings) (component.DeployWaiter, error) { +func (r *Reconciler) newVictoriaLogs(seed *seedpkg.Seed) (component.DeployWaiter, error) { var storage *resource.Quantity if r.Config.Logging != nil && r.Config.Logging.VictoriaLogs != nil && r.Config.Logging.VictoriaLogs.Garden != nil { storage = r.Config.Logging.VictoriaLogs.Garden.Storage } + pvcAutoscalerEnabled := v1beta1helper.SeedSettingPersistentVolumeClaimAutoscalerEnabled(seed.GetInfo().Spec.Settings) + if pvcAutoscalerEnabled { + storage = new(resource.MustParse(seed.GetValidVolumeSize("5Gi"))) + } + deployer, err := sharedcomponent.NewVictoriaLogs( r.SeedClientSet.Client(), r.GardenNamespace, @@ -640,7 +645,7 @@ func (r *Reconciler) newVictoriaLogs(seedSettings *gardencorev1beta1.SeedSetting storage, false, victorialogs.PVCAutoscalingConfig{ - Enabled: v1beta1helper.SeedSettingPersistentVolumeClaimAutoscalerEnabled(seedSettings), + Enabled: pvcAutoscalerEnabled, MaxCapacity: resource.MustParse("200Gi"), }, ) diff --git a/pkg/gardenlet/operation/botanist/logging.go b/pkg/gardenlet/operation/botanist/logging.go index 8e292020306a..91615d519cb1 100644 --- a/pkg/gardenlet/operation/botanist/logging.go +++ b/pkg/gardenlet/operation/botanist/logging.go @@ -240,16 +240,23 @@ func (b *Botanist) DefaultOtelCollector() (collector.Interface, error) { // DefaultVictoriaLogs returns a deployer for VictoriaLogs. func (b *Botanist) DefaultVictoriaLogs() (component.DeployWaiter, error) { + var storage *resource.Quantity + + pvcAutoscalerEnabled := v1beta1helper.SeedSettingPersistentVolumeClaimAutoscalerEnabled(b.Seed.GetInfo().Spec.Settings) + if pvcAutoscalerEnabled { + storage = new(resource.MustParse(b.GetValidVolumeSize("5Gi"))) + } + deployer, err := shared.NewVictoriaLogs( b.SeedClientSet.Client(), b.Shoot.ControlPlaneNamespace, component.ClusterTypeShoot, b.Shoot.GetReplicas(1), v1beta1constants.PriorityClassNameShootControlPlane100, - nil, + storage, false, victorialogs.PVCAutoscalingConfig{ - Enabled: v1beta1helper.SeedSettingPersistentVolumeClaimAutoscalerEnabled(b.Seed.GetInfo().Spec.Settings), + Enabled: pvcAutoscalerEnabled, MaxCapacity: resource.MustParse("40Gi"), }, ) diff --git a/pkg/gardenlet/operation/botanist/logging_test.go b/pkg/gardenlet/operation/botanist/logging_test.go index a8bb24b5a620..f9b8701c445a 100644 --- a/pkg/gardenlet/operation/botanist/logging_test.go +++ b/pkg/gardenlet/operation/botanist/logging_test.go @@ -8,11 +8,14 @@ import ( "context" "fmt" + victoriametricsv1 "github.com/VictoriaMetrics/operator/api/operator/v1" "github.com/go-logr/logr" . "github.com/onsi/ginkgo/v2" . "github.com/onsi/gomega" "go.uber.org/mock/gomock" appsv1 "k8s.io/api/apps/v1" + corev1 "k8s.io/api/core/v1" + "k8s.io/apimachinery/pkg/api/resource" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/client-go/rest" "sigs.k8s.io/controller-runtime/pkg/client" @@ -27,6 +30,7 @@ import ( "github.com/gardener/gardener/pkg/client/kubernetes/mock" mockcomponent "github.com/gardener/gardener/pkg/component/mock" mockvali "github.com/gardener/gardener/pkg/component/observability/logging/vali/mock" + victorialogsconstants "github.com/gardener/gardener/pkg/component/observability/logging/victorialogs/constants" mockcollector "github.com/gardener/gardener/pkg/component/observability/opentelemetry/collector/mock" "github.com/gardener/gardener/pkg/features" gardenletfeatures "github.com/gardener/gardener/pkg/gardenlet/features" @@ -34,6 +38,7 @@ import ( . "github.com/gardener/gardener/pkg/gardenlet/operation/botanist" seedpkg "github.com/gardener/gardener/pkg/gardenlet/operation/seed" shootpkg "github.com/gardener/gardener/pkg/gardenlet/operation/shoot" + "github.com/gardener/gardener/pkg/utils/managedresources" secretsmanager "github.com/gardener/gardener/pkg/utils/secrets/manager" fakesecretsmanager "github.com/gardener/gardener/pkg/utils/secrets/manager/fake" "github.com/gardener/gardener/pkg/utils/test" @@ -376,4 +381,48 @@ var _ = Describe("Logging", func() { }) }) }) + + DescribeTable("#DefaultVictoriaLogs PVC storage", + func(pvcAutoscalerEnabled bool, minimumVolumeSize *resource.Quantity, expectedStorage resource.Quantity) { + DeferCleanup(test.WithFeatureGate(features.DefaultFeatureGate, features.VictoriaLogsBackend, true)) + gardenletfeatures.RegisterFeatureGates() + + var volume *gardencorev1beta1.SeedVolume + if minimumVolumeSize != nil { + volume = &gardencorev1beta1.SeedVolume{MinimumSize: minimumVolumeSize} + } + + botanist.Seed.SetInfo(&gardencorev1beta1.Seed{ + Spec: gardencorev1beta1.SeedSpec{ + Volume: volume, + Settings: &gardencorev1beta1.SeedSettings{ + PersistentVolumeClaimAutoscaler: &gardencorev1beta1.SeedSettingPersistentVolumeClaimAutoscaler{ + Enabled: pvcAutoscalerEnabled, + }, + }, + }, + }) + + deployer, err := botanist.DefaultVictoriaLogs() + Expect(err).NotTo(HaveOccurred()) + Expect(deployer.Deploy(ctx)).To(Succeed()) + + objects, err := managedresources.GetObjects(ctx, fakeClient, controlPlaneNamespace, victorialogsconstants.ManagedResourceNameRuntime) + Expect(err).NotTo(HaveOccurred()) + + var vlSingle *victoriametricsv1.VLSingle + for _, obj := range objects { + if vl, ok := obj.(*victoriametricsv1.VLSingle); ok { + vlSingle = vl + break + } + } + Expect(vlSingle).NotTo(BeNil(), "expected a VLSingle resource in the VictoriaLogs managed resource") + Expect(vlSingle.Spec.Storage.Resources.Requests[corev1.ResourceStorage]).To(Equal(expectedStorage)) + }, + Entry("small volume when the PVC autoscaler is enabled", true, nil, resource.MustParse("5Gi")), + Entry("default volume when the PVC autoscaler is disabled", false, nil, resource.MustParse("30Gi")), + Entry("clamped to the seed minimum volume size when the PVC autoscaler is enabled", true, new(resource.MustParse("20Gi")), resource.MustParse("20Gi")), + Entry("initial size when it exceeds the seed minimum volume size", true, new(resource.MustParse("2Gi")), resource.MustParse("5Gi")), + ) }) From 76d6b639a5976aef34938d2aaf7368906fa19275 Mon Sep 17 00:00:00 2001 From: Teodor Dichev <96772763+TeodorDichev@users.noreply.github.com> Date: Wed, 5 Aug 2026 12:47:14 +0300 Subject: [PATCH 2/4] Remove deprecated prometheus environment variables from `victoria_operator` (#15391) --- .../victoria/operator/victoria_operator.go | 26 +------------------ .../operator/victoria_operator_test.go | 26 +------------------ 2 files changed, 2 insertions(+), 50 deletions(-) diff --git a/pkg/component/observability/logging/victoria/operator/victoria_operator.go b/pkg/component/observability/logging/victoria/operator/victoria_operator.go index 3cf8efcfd005..69875c4ae3ab 100644 --- a/pkg/component/observability/logging/victoria/operator/victoria_operator.go +++ b/pkg/component/observability/logging/victoria/operator/victoria_operator.go @@ -158,37 +158,13 @@ func (v *victoriaOperator) deployment() *appsv1.Deployment { "--leader-elect", fmt.Sprintf("--health-probe-bind-address=:%d", healthProbePort), fmt.Sprintf("--metrics-bind-address=:%d", metricsPort), - "--controller.disableReconcileFor=VLAgent,VLCluster,VLogs,VMAgent,VMAlert,VMAlertmanager,VMAlertmanagerConfig,VMAnomaly,VMAuth,VMCluster,VMNodeScrape,VMPodScrape,VMProbe,VMRule,VMScrapeConfig,VMServiceScrape,VMSingle,VMStaticScrape,VMUser,VTSingle,VTCluster", + "--controller.disableReconcileFor=VLAgent,VLCluster,VLogs,VMAgent,VMAlert,VMAlertmanager,VMAlertmanagerConfig,VMAnomaly,VMAuth,VMCluster,VMNodeScrape,VMPodScrape,VMProbe,VMRule,VMScrapeConfig,VMServiceScrape,VMSingle,VMStaticScrape,VMUser,VTSingle,VTCluster,PodMonitor,ServiceMonitor,PrometheusRule,Probe,AlertmanagerConfig,ScrapeConfig", }, Env: []corev1.EnvVar{ { Name: "WATCH_NAMESPACE", Value: "", }, - { - Name: "VM_ENABLEDPROMETHEUSCONVERTER_PODMONITOR", - Value: "false", - }, - { - Name: "VM_ENABLEDPROMETHEUSCONVERTER_SERVICESCRAPE", - Value: "false", - }, - { - Name: "VM_ENABLEDPROMETHEUSCONVERTER_PROMETHEUSRULE", - Value: "false", - }, - { - Name: "VM_ENABLEDPROMETHEUSCONVERTER_PROBE", - Value: "false", - }, - { - Name: "VM_ENABLEDPROMETHEUSCONVERTER_ALERTMANAGERCONFIG", - Value: "false", - }, - { - Name: "VM_ENABLEDPROMETHEUSCONVERTER_SCRAPECONFIG", - Value: "false", - }, { Name: "VM_DISABLESELFSERVICESCRAPECREATION", Value: "true", diff --git a/pkg/component/observability/logging/victoria/operator/victoria_operator_test.go b/pkg/component/observability/logging/victoria/operator/victoria_operator_test.go index 1832cbcfef06..59ef9dba37c1 100644 --- a/pkg/component/observability/logging/victoria/operator/victoria_operator_test.go +++ b/pkg/component/observability/logging/victoria/operator/victoria_operator_test.go @@ -158,37 +158,13 @@ var _ = Describe("VictoriaOperator", func() { "--leader-elect", "--health-probe-bind-address=:8081", "--metrics-bind-address=:8080", - "--controller.disableReconcileFor=VLAgent,VLCluster,VLogs,VMAgent,VMAlert,VMAlertmanager,VMAlertmanagerConfig,VMAnomaly,VMAuth,VMCluster,VMNodeScrape,VMPodScrape,VMProbe,VMRule,VMScrapeConfig,VMServiceScrape,VMSingle,VMStaticScrape,VMUser,VTSingle,VTCluster", + "--controller.disableReconcileFor=VLAgent,VLCluster,VLogs,VMAgent,VMAlert,VMAlertmanager,VMAlertmanagerConfig,VMAnomaly,VMAuth,VMCluster,VMNodeScrape,VMPodScrape,VMProbe,VMRule,VMScrapeConfig,VMServiceScrape,VMSingle,VMStaticScrape,VMUser,VTSingle,VTCluster,PodMonitor,ServiceMonitor,PrometheusRule,Probe,AlertmanagerConfig,ScrapeConfig", }, Env: []corev1.EnvVar{ { Name: "WATCH_NAMESPACE", Value: "", }, - { - Name: "VM_ENABLEDPROMETHEUSCONVERTER_PODMONITOR", - Value: "false", - }, - { - Name: "VM_ENABLEDPROMETHEUSCONVERTER_SERVICESCRAPE", - Value: "false", - }, - { - Name: "VM_ENABLEDPROMETHEUSCONVERTER_PROMETHEUSRULE", - Value: "false", - }, - { - Name: "VM_ENABLEDPROMETHEUSCONVERTER_PROBE", - Value: "false", - }, - { - Name: "VM_ENABLEDPROMETHEUSCONVERTER_ALERTMANAGERCONFIG", - Value: "false", - }, - { - Name: "VM_ENABLEDPROMETHEUSCONVERTER_SCRAPECONFIG", - Value: "false", - }, { Name: "VM_DISABLESELFSERVICESCRAPECREATION", Value: "true", From 248a180acface03fb21761c99a3e2efe55b2c174 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Oliver=20G=C3=B6tz?= <47362717+oliver-goetz@users.noreply.github.com> Date: Wed, 5 Aug 2026 11:47:22 +0200 Subject: [PATCH 3/4] Disable HTTP keep-alive in `istio-ingressgateway` when the CPU utilization of their nodes exceeds 85% (#15417) * Disable HTTP keep-alive in `istio-ingressgateway` when the CPU utilization of their nodes exceeds 85% * Collect and scrape envoy goaway metrics --- .../templates/bootstrap-override.yaml | 21 ++++++++++++++++++ .../istio-ingress/templates/deployment.yaml | 12 ++++++++++ pkg/component/networking/istio/istio_test.go | 15 ++++++++++--- pkg/component/networking/istio/istiod.go | 1 + .../ingress_bootstrap_override.yaml | 22 +++++++++++++++++++ .../istio/test_charts/ingress_deployment.yaml | 12 ++++++++++ .../test_charts/ingress_servicemonitor.yaml | 2 +- 7 files changed, 81 insertions(+), 4 deletions(-) create mode 100644 pkg/component/networking/istio/charts/istio/istio-ingress/templates/bootstrap-override.yaml create mode 100644 pkg/component/networking/istio/test_charts/ingress_bootstrap_override.yaml diff --git a/pkg/component/networking/istio/charts/istio/istio-ingress/templates/bootstrap-override.yaml b/pkg/component/networking/istio/charts/istio/istio-ingress/templates/bootstrap-override.yaml new file mode 100644 index 000000000000..097cd5688343 --- /dev/null +++ b/pkg/component/networking/istio/charts/istio/istio-ingress/templates/bootstrap-override.yaml @@ -0,0 +1,21 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + labels: +{{ .Values.labels | toYaml | indent 4 }} + name: istio-ingressgateway-bootstrap-override + namespace: {{ .Release.Namespace }} +data: + bootstrap.yaml: | + overload_manager: + refresh_interval: 1s + resource_monitors: + - name: envoy.resource_monitors.cpu_utilization + typed_config: + "@type": type.googleapis.com/envoy.extensions.resource_monitors.cpu_utilization.v3.CpuUtilizationConfig + actions: + - name: envoy.overload_actions.disable_http_keepalive + triggers: + - name: envoy.resource_monitors.cpu_utilization + threshold: + value: 0.85 diff --git a/pkg/component/networking/istio/charts/istio/istio-ingress/templates/deployment.yaml b/pkg/component/networking/istio/charts/istio/istio-ingress/templates/deployment.yaml index 5c5f789ef751..cb071c4b9c43 100644 --- a/pkg/component/networking/istio/charts/istio/istio-ingress/templates/deployment.yaml +++ b/pkg/component/networking/istio/charts/istio/istio-ingress/templates/deployment.yaml @@ -30,6 +30,7 @@ spec: service.istio.io/canonical-name: "istio-ingressgateway" service.istio.io/canonical-revision: "1.29" annotations: + checksum/bootstrap-override: {{ include (print $.Template.BasePath "/bootstrap-override.yaml") . | sha256sum }} sidecar.istio.io/inject: "false" # Evict stale metrics (e.g. for old kube-apiserver pods) after inactivity to prevent unbounded metric growth. # Replaces the deprecated METRIC_ROTATION_INTERVAL env var removed in Istio v1.28. @@ -42,6 +43,9 @@ spec: # See also https://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76 "overload.premature_reset_total_stream_count": "100" "overload.premature_reset_min_stream_lifetime_seconds": "1" + proxyStatsMatcher: + inclusionRegexps: + - ".*goaway.*" spec: serviceAccountName: istio-ingressgateway-service-account securityContext: @@ -90,6 +94,8 @@ spec: env: - name: PILOT_CERT_PROVIDER value: istiod + - name: ISTIO_BOOTSTRAP_OVERRIDE + value: /etc/istio/bootstrap-override/bootstrap.yaml - name: CA_ADDR value: istiod.{{ .Values.istiodNamespace }}.svc:15012 - name: NODE_NAME @@ -158,6 +164,9 @@ spec: mountPath: /etc/istio/proxy - name: config-volume mountPath: /etc/istio/config + - name: bootstrap-override-volume + mountPath: /etc/istio/bootstrap-override + readOnly: true - mountPath: /var/run/secrets/istio name: istiod-ca-cert - name: istio-token @@ -207,6 +216,9 @@ spec: configMap: name: istio optional: true + - name: bootstrap-override-volume + configMap: + name: istio-ingressgateway-bootstrap-override - name: ingressgateway-certs secret: secretName: "istio-ingressgateway-certs" diff --git a/pkg/component/networking/istio/istio_test.go b/pkg/component/networking/istio/istio_test.go index 811e3fe5936c..a7c54c42443b 100644 --- a/pkg/component/networking/istio/istio_test.go +++ b/pkg/component/networking/istio/istio_test.go @@ -41,6 +41,8 @@ var _ = Describe("istiod", func() { const ( deployNS = "test" deployNSIngress = "test-ingress" + + ingressBootstrapOverrideChecksum = "7da3338166d3dcdbab977651cf2e809b70b20c8a6d8cab00f1521fc4172b6939" ) var ( @@ -228,10 +230,16 @@ var _ = Describe("istiod", func() { return string(data) } - istioIngressDeployment = func(replicas *int) string { + istioIngressDeployment = func(replicas *int, checksum string) string { data, _ := os.ReadFile("./test_charts/ingress_deployment.yaml") str := strings.ReplaceAll(string(data), "", strconv.Itoa(ptr.Deref(replicas, 2))) - return strings.ReplaceAll(str, "", expectedCPURequests) + str = strings.ReplaceAll(str, "", expectedCPURequests) + return strings.ReplaceAll(str, "", checksum) + } + + istioIngressBootstrapOverride = func() string { + data, _ := os.ReadFile("./test_charts/ingress_bootstrap_override.yaml") + return string(data) } istioIngressServiceMonitor = func() string { @@ -408,7 +416,8 @@ var _ = Describe("istiod", func() { istioIngressRoleBinding(), istioIngressServiceInternal(), istioIngressServiceAccount(), - istioIngressDeployment(minReplicas), + istioIngressDeployment(minReplicas, ingressBootstrapOverrideChecksum), + istioIngressBootstrapOverride(), istioIngressEnvoyFilter(), istioIngressMisdirectedRequestsEnvoyFilter(), istioIngressServiceMonitor(), diff --git a/pkg/component/networking/istio/istiod.go b/pkg/component/networking/istio/istiod.go index d948993ca6a5..be708911794d 100644 --- a/pkg/component/networking/istio/istiod.go +++ b/pkg/component/networking/istio/istiod.go @@ -295,6 +295,7 @@ func (i *istiod) Deploy(ctx context.Context) error { "envoy_cluster_upstream_cx_rx_bytes_total", "envoy_cluster_upstream_cx_total", "envoy_cluster_upstream_cx_tx_bytes_total", + "envoy_http2_goaway_sent", "envoy_server_hot_restart_epoch", "istio_build", "istio_request_bytes_count", diff --git a/pkg/component/networking/istio/test_charts/ingress_bootstrap_override.yaml b/pkg/component/networking/istio/test_charts/ingress_bootstrap_override.yaml new file mode 100644 index 000000000000..cd7be9489619 --- /dev/null +++ b/pkg/component/networking/istio/test_charts/ingress_bootstrap_override.yaml @@ -0,0 +1,22 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + labels: + app: istio-ingressgateway + foo: bar + name: istio-ingressgateway-bootstrap-override + namespace: test-ingress +data: + bootstrap.yaml: | + overload_manager: + refresh_interval: 1s + resource_monitors: + - name: envoy.resource_monitors.cpu_utilization + typed_config: + "@type": type.googleapis.com/envoy.extensions.resource_monitors.cpu_utilization.v3.CpuUtilizationConfig + actions: + - name: envoy.overload_actions.disable_http_keepalive + triggers: + - name: envoy.resource_monitors.cpu_utilization + threshold: + value: 0.85 diff --git a/pkg/component/networking/istio/test_charts/ingress_deployment.yaml b/pkg/component/networking/istio/test_charts/ingress_deployment.yaml index c18a221bf25e..30630771084e 100644 --- a/pkg/component/networking/istio/test_charts/ingress_deployment.yaml +++ b/pkg/component/networking/istio/test_charts/ingress_deployment.yaml @@ -30,6 +30,7 @@ spec: service.istio.io/canonical-name: "istio-ingressgateway" service.istio.io/canonical-revision: "1.29" annotations: + checksum/bootstrap-override: sidecar.istio.io/inject: "false" # Evict stale metrics (e.g. for old kube-apiserver pods) after inactivity to prevent unbounded metric growth. # Replaces the deprecated METRIC_ROTATION_INTERVAL env var removed in Istio v1.28. @@ -42,6 +43,9 @@ spec: # See also https://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76 "overload.premature_reset_total_stream_count": "100" "overload.premature_reset_min_stream_lifetime_seconds": "1" + proxyStatsMatcher: + inclusionRegexps: + - ".*goaway.*" spec: serviceAccountName: istio-ingressgateway-service-account securityContext: @@ -88,6 +92,8 @@ spec: env: - name: PILOT_CERT_PROVIDER value: istiod + - name: ISTIO_BOOTSTRAP_OVERRIDE + value: /etc/istio/bootstrap-override/bootstrap.yaml - name: CA_ADDR value: istiod.istio-test-system.svc:15012 - name: NODE_NAME @@ -152,6 +158,9 @@ spec: mountPath: /etc/istio/proxy - name: config-volume mountPath: /etc/istio/config + - name: bootstrap-override-volume + mountPath: /etc/istio/bootstrap-override + readOnly: true - mountPath: /var/run/secrets/istio name: istiod-ca-cert - name: istio-token @@ -201,6 +210,9 @@ spec: configMap: name: istio optional: true + - name: bootstrap-override-volume + configMap: + name: istio-ingressgateway-bootstrap-override - name: ingressgateway-certs secret: secretName: "istio-ingressgateway-certs" diff --git a/pkg/component/networking/istio/test_charts/ingress_servicemonitor.yaml b/pkg/component/networking/istio/test_charts/ingress_servicemonitor.yaml index b5fcb08cf39e..423399cca552 100644 --- a/pkg/component/networking/istio/test_charts/ingress_servicemonitor.yaml +++ b/pkg/component/networking/istio/test_charts/ingress_servicemonitor.yaml @@ -9,7 +9,7 @@ spec: endpoints: - metricRelabelings: - action: keep - regex: ^(envoy_cluster_upstream_cx_active|envoy_cluster_upstream_cx_connect_fail|envoy_cluster_upstream_cx_rx_bytes_total|envoy_cluster_upstream_cx_total|envoy_cluster_upstream_cx_tx_bytes_total|envoy_server_hot_restart_epoch|istio_build|istio_request_bytes_count|istio_request_bytes_sum|istio_request_duration_milliseconds_count|istio_request_duration_milliseconds_sum|istio_requests_total|istio_response_bytes_count|istio_response_bytes_sum|istio_tcp_connections_closed_total|istio_tcp_connections_opened_total|istio_tcp_received_bytes_total|istio_tcp_sent_bytes_total)$ + regex: ^(envoy_cluster_upstream_cx_active|envoy_cluster_upstream_cx_connect_fail|envoy_cluster_upstream_cx_rx_bytes_total|envoy_cluster_upstream_cx_total|envoy_cluster_upstream_cx_tx_bytes_total|envoy_http2_goaway_sent|envoy_server_hot_restart_epoch|istio_build|istio_request_bytes_count|istio_request_bytes_sum|istio_request_duration_milliseconds_count|istio_request_duration_milliseconds_sum|istio_requests_total|istio_response_bytes_count|istio_response_bytes_sum|istio_tcp_connections_closed_total|istio_tcp_connections_opened_total|istio_tcp_received_bytes_total|istio_tcp_sent_bytes_total)$ sourceLabels: - __name__ path: /stats/prometheus From 9bcb7a578ad7bda872fe88dc994a2f3e32b5ea8a Mon Sep 17 00:00:00 2001 From: Gardener Prow Robot Date: Wed, 5 Aug 2026 11:47:30 +0200 Subject: [PATCH 4/4] Update dependency gardener/vpn2 to v0.52.0 (#15429) --- imagevector/containers.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/imagevector/containers.yaml b/imagevector/containers.yaml index f55f17302537..ed1944119625 100644 --- a/imagevector/containers.yaml +++ b/imagevector/containers.yaml @@ -171,7 +171,7 @@ images: - name: vpn-server sourceRepository: github.com/gardener/vpn2 repository: europe-docker.pkg.dev/gardener-project/releases/gardener/vpn-server - tag: "0.51.0" + tag: "0.52.0" # OpenTelemetry - name: opentelemetry-operator sourceRepository: github.com/open-telemetry/opentelemetry-operator @@ -480,7 +480,7 @@ images: - name: vpn-client sourceRepository: github.com/gardener/vpn2 repository: europe-docker.pkg.dev/gardener-project/releases/gardener/vpn-client - tag: "0.51.0" + tag: "0.52.0" - name: coredns sourceRepository: github.com/coredns/coredns repository: registry.k8s.io/coredns/coredns