Skip to content

🌱 Skip graceful shutdown if lease is lost during shutdown - #3651

Open
sbueringer wants to merge 1 commit into
kubernetes-sigs:mainfrom
sbueringer:pr-improve-shutdown
Open

sbueringer wants to merge 1 commit into
kubernetes-sigs:mainfrom
sbueringer:pr-improve-shutdown

Conversation

@sbueringer

@sbueringer sbueringer commented Nov 4, 2026 •

Copy link
Copy Markdown
Member

I think we want a manager to shutdown as quickly as possible if we lose the leader lease.

What already worked is that if the manager is running and we lose the leader lease we ~ skip the graceful shutdown.

What didn't work is that if we were already shutting down gracefully losing the leader lease during that did not cancel the ongoing graceful shutdown.

@kubernetes-prow

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sbueringer

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubernetes-prow kubernetes-prow Bot added approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Nov 4, 2026
@sbueringer

Copy link
Copy Markdown
Member Author

/hold
for Alvaro's review

/assign @alvaroaleman

@kubernetes-prow kubernetes-prow Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Nov 4, 2026
Comment thread pkg/manager/internal.go
Comment on lines +649 to +651
// NOTE: This must be closed at most once. That holds because we call Run only once
// and don't set LeaderElectionConfig.Recovery: with Recovery, client-go can call
// OnStoppedLeading multiple times per Run, which would panic here on a double close.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the explanation why closing the channel below is not in a sync.Once. I'm fine either dropping the comment or with dropping the comment and using a sync.Once just to be safe

Comment thread pkg/manager/internal.go
// It can be overridden for tests.
onStoppedLeading func()

// shutdownCtx is the context that can be used during shutdown. It will be cancelled

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is no reason (anymore, also before this PR) why this has to be a field on the struct instead of just a local variable, so I changed that to simplify

@alvaroaleman alvaroaleman left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have to look deeper but don't we cancel the leader lease ctx during shutdown and thus will always run into this case?

@sbueringer

sbueringer commented Nov 5, 2026 •

Copy link
Copy Markdown
Member Author

don't we cancel the leader lease ctx during shutdown and thus will always run into this case?

cm.leaderElectionCancel is only called in a defer func in engageStopProcedure
That defer func is only reached after <-shutdownCtx.Done() (l.615)
The select in the go func (l.525++) will return when the shutdownCtx is done instead of logging and calling shutdownCancel

(I'll flip the order in that select just in case it makes it more robust that we hit the shutdownCtx.Done() branch, not sure if it makes a difference)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants