asdf

charts/pod-graceful-drain/templates/deployment.yaml

@@ -41,9 +41,6 @@ spec:
             {{- with .Values.deleteAfter }}
             - --delete-after={{ . }}
             {{- end }}
-            {{- if .Values.ignoreError }}
-            - --ignore-error
-            {{- end }}
             {{- if .Values.experimentalGeneralIngress }}
             - --experimental-general-ingress
             {{- end }}

charts/pod-graceful-drain/templates/webhook.yaml

@@ -20,15 +20,14 @@ webhooks:
         name: {{ template "pod-graceful-drain.fullname" . }}-webhook-service
         namespace: {{ .Release.Namespace }}
         path: /webhook/validate
-    failurePolicy: {{ if .Values.ignoreError -}}Ignore{{- else -}}Fail{{end}}
+    failurePolicy: Ignore
     name: validate.pod-graceful-drain.io
     rules:
       - apiGroups: [ "" ]
         apiVersions: [ v1 ]
         operations: [ DELETE ]
         resources: [ pods ]
     sideEffects: NoneOnDryRun
-    timeoutSeconds: {{ .Values.webhookTimeoutSeconds }}
     {{- with .Values.namespaceSelector }}
     namespaceSelector:
       {{- toYaml . | nindent 6 }}
@@ -54,7 +53,7 @@ webhooks:
         name: {{ template "pod-graceful-drain.fullname" . }}-webhook-service
         namespace: {{ .Release.Namespace }}
         path: /webhook/mutate
-    failurePolicy: {{ if .Values.ignoreError -}}Ignore{{- else -}}Fail{{end}}
+    failurePolicy: Ignore
     name: mutate.pod-graceful-drain.io
     rules:
       - apiGroups: [ "" ]

charts/pod-graceful-drain/values.yaml

@@ -52,15 +52,11 @@ metrics:
 
 # Set the manager log level: info, debug (default: info)
 logLevel:
-# Amount of time that a pod is deleted after a denial of an admission (default: 25s)
+# Amount of time that a pod is deleted after a denial of an admission (default: 90s)
 deleteAfter:
-# Allow pod deletion even if there were errors during the pod deletion interception (default: true)
-ignoreError: true
 experimentalGeneralIngress: false
 
 # Time period for the controller pod to do a graceful shutdown. It should be greater than deleteAfter
-terminationGracePeriodSeconds: 30
-# Timeout for the ValidatingAdmissionWebhook. It should be long enough since admission delay cap is determined by this value
-webhookTimeoutSeconds: 30
+terminationGracePeriodSeconds: 100
 # webhook's namespaceSelector to limit where the pod-graceful-drain is applied
 namespaceSelector: { }

src/config.rs

@@ -9,9 +9,6 @@ pub struct Config {
     #[arg(long, default_value = "30s", value_parser = parse_duration)]
     pub delete_after: Duration,
 
-    #[arg(long, default_value = "true")]
-    pub ignore_error: bool,
-
     #[arg(long, default_value = "false")]
     pub experimental_general_ingress: bool,
 }

src/controller.rs

@@ -22,7 +22,7 @@ use crate::loadbalancing::LoadBalancingConfig;
 use crate::pod_draining_info::{get_pod_draining_info, PodDrainingInfo};
 use crate::shutdown::Shutdown;
 use crate::spawn_service::spawn_service;
-use crate::status::{is_conflict_error, is_gone_error, is_not_found_error};
+use crate::status::{is_404_not_found_error, is_409_conflict_error, is_410_gone_error};
 use crate::{instrumented, ServiceRegistry};
 
 /// Start a controller that deletes deregistered pods.
@@ -108,7 +108,7 @@ async fn reconcile(
 fn error_policy(_pod: Arc<Pod>, err: &ReconcileError, _context: Arc<ReconcilerContext>) -> Action {
     match err {
         ReconcileError::KubeError(err) => {
-            if is_conflict_error(err) {
+            if is_409_conflict_error(err) {
                 return Action::requeue(Duration::from_secs(1));
             }
         }
@@ -127,7 +127,7 @@ async fn log_reconcile_result(
                 trace!(%object_ref, ?action, "success");
             }
             Err(controller::Error::ReconcilerFailed(err, object_ref)) => match err {
-                ReconcileError::KubeError(err) if is_conflict_error(&err) => {
+                ReconcileError::KubeError(err) if is_409_conflict_error(&err) => {
                     debug!(%object_ref, ?err, "conflict");
                 }
                 _ => error!(%object_ref, ?err, "error"),
@@ -155,7 +155,7 @@ async fn delete_pod(api_resolver: &ApiResolver, pod: &Pod) -> kube::Result<()> {
     let result = api.delete(&name, &delete_params).await;
     match result {
         Ok(_) => Ok(()),
-        Err(err) if is_not_found_error(&err) || is_gone_error(&err) => {
+        Err(err) if is_404_not_found_error(&err) || is_410_gone_error(&err) => {
             debug!("pod is gone anyway"); // This is what we desired.
             Ok(())
         }

src/pod_state.rs

@@ -196,7 +196,6 @@ mod tests {
     fn get_test_experimental_general_ingress_config() -> Config {
         Config {
             experimental_general_ingress: true,
-            ignore_error: false,
             delete_after: Duration::from_secs(30),
         }
     }
@@ -395,7 +394,6 @@ mod tests {
         assert!(is_pod_exposed(
             &Config {
                 delete_after: Duration::from_secs(30),
-                ignore_error: true,
                 experimental_general_ingress: false,
             },
             &stores,

src/status.rs

@@ -5,13 +5,14 @@ const STATUS_CODE_404_NOT_FOUND: u16 = 404;
 const STATUS_CODE_408_TIMEOUT: u16 = 408;
 const STATUS_CODE_409_CONFLICT: u16 = 409;
 const STATUS_CODE_410_GONE: u16 = 410;
+const STATUS_CODE_422_UNPROCESSABLE_ENTITY: u16 = 422;
 const STATUS_CODE_429_TOO_MANY_REQUESTS: u16 = 429;
 const STATUS_CODE_500_INTERNAL_SERVER_ERROR: u16 = 500;
 const STATUS_CODE_502_BAD_GATEWAY: u16 = 502;
 const STATUS_CODE_503_SERVICE_UNAVAILABLE: u16 = 503;
 const STATUS_CODE_504_GATEWAY_TIMEOUT: u16 = 504;
 
-pub fn is_not_found_error(err: &Error) -> bool {
+pub fn is_404_not_found_error(err: &Error) -> bool {
     matches!(
         err,
         Error::Api(ErrorResponse {
@@ -21,7 +22,7 @@ pub fn is_not_found_error(err: &Error) -> bool {
     )
 }
 
-pub fn is_conflict_error(err: &Error) -> bool {
+pub fn is_409_conflict_error(err: &Error) -> bool {
     matches!(
         err,
         Error::Api(ErrorResponse {
@@ -31,7 +32,7 @@ pub fn is_conflict_error(err: &Error) -> bool {
     )
 }
 
-pub fn is_gone_error(err: &Error) -> bool {
+pub fn is_410_gone_error(err: &Error) -> bool {
     matches!(
         err,
         Error::Api(ErrorResponse {
@@ -41,6 +42,17 @@ pub fn is_gone_error(err: &Error) -> bool {
     )
 }
 
+pub fn is_generic_server_response_422_invalid_for_json_patch_error(err: &Error) -> bool {
+    matches!(
+        err,
+        Error::Api(ErrorResponse {
+            code,
+            reason,
+            ..
+        }) if *code == STATUS_CODE_422_UNPROCESSABLE_ENTITY && reason == "Invalid"
+    )
+}
+
 pub fn is_transient_error(err: &Error) -> bool {
     match err {
         Error::Api(ErrorResponse {