Repository navigation
e2e: with no probe client available the LB datapath capture stamps every LB as reachable #3658
Description
Summary
In hack/e2e-capture-dataplane.sh, when the LB probe produces zero outcomes because no probe client exists (neither nc nor curl reachable in the host netns), lb_capture_decision hits its n == 0 branch and prints skip (line 183 at 605030b), which routes to the artifact line "probe: LB reachable or not probeable from -- reachable, skipped" (line 672). The artifact asserts reachability of an address no probe ever touched; the actual fact is "no probe could run".
Why it matters
This is the same class as the reachability-verdict-from-empty-probes defect just fixed in the bounding branch for #3642, at a sixth site that predates that branch: a conclusion inferred from missing data rather than a statement that data is missing. A minimal e2e image without nc/curl in the host netns would stamp every LB as reachable and silently skip the entire heavy-capture leg, which reads as a healthy datapath.
Fix shape
Give n == 0 its own outcome ("unknown: no probe client available") instead of folding it into skip, and let the artifact line say that no probe ran. The distinction machinery (an explicit unknown verdict that does not collapse into either answer) exists in the in-flight branch already; this site just needs to route through it.
Activity
lexfrei commentedon Aug 8, 2026
Scope update: the unprobed-input set is wider than the description says. Three distinct inputs reach the
skipbranch and its "reachable, skipped" artifact line without any probe running: an empty_probenode(neither the announcer nor the endpoint node resolved), an_lbportof 0, and the no-probe-client case the description covers. The first was reproduced under dash with a stub whereget svcanswers butendpointslicesdoes not; the artifact then asserts reachability of an address the script never touched. All three exist verbatim on the merge base. The fix shape stays the same, applied to the branch rather than to one condition: every path intoskipthat ran zero probes should route to the explicit unknown outcome instead.lexfrei commentedon Aug 8, 2026
Fourth unprobed input into the
skipbranch, found by a second independent pass: a failingkubectl execitself (127 with notimeouton PATH, exec forbidden by policy, or the pod disappearing mid-probe) also emits no outcome token, and zero tokens still routes to "reachable, skipped". Same fix shape: any path that ran zero probes routes to the explicit unknown outcome.fix(tests): bound the e2e data-plane capture's reads and stop inferri…
lexfrei commentedon Aug 8, 2026
Correcting the count in my earlier scope notes: the unprobed inputs that reach "reachable, skipped" on the merge base are FIVE, not four. Measured by running all six routes against the merge-base script: no probe node, port 0, no kube-ovn-cni pod on the node, no TCP/HTTP client in its host netns, and an exec that could not run. The sixth candidate, a cni-server lookup that never answered, already routed to unknown before any of this work, so it does not belong in the list. The earlier "four" came from reading the routes rather than exercising them.
fix(e2e): stop the data-plane capture reporting what it never observed (
lexfrei commentedon Sep 23, 2026
Fixed by #3672. All five no-probe paths now record the LB as unprobed with a reason instead of reachable, and each one has a test in
hack/capture-dataplane.bats.