Connection tracking issue

[dynek]

Hello everyone,

I'm running version v1.30.4+k3s1 - I will upgrade but it will take time in my environment.

Now regarding my question: any idea what could cause connection tracking to not be deleted when pod IP changes ?
I'm not sure if it's specific to UDP traffic, but I see connection trackings for old IPs, and as soon as I flush the related tracking, the new pod start receiving the traffic as expected and a new tracking appears.

$ sudo kubectl get pods -A -o wide
NAMESPACE  NAME  READY  STATUS   RESTARTS  AGE    IP             NODE
[..]       [..]  1/1    Running  0         10m    172.48.0.93    [..]

$ sudo conntrack -L | grep "10019"
udp      17 29 src=192.168.177.3 dst=192.168.180.64 sport=41975 dport=10019 [UNREPLIED] src=172.48.0.91 dst=192.168.177.3 sport=10019 dport=41975 mark=0 use=98
conntrack v1.4.6 (conntrack-tools): 211 flow entries have been shown.

$ sudo conntrack -D -p udp --dport 10019
udp      17 29 src=192.168.177.3 dst=192.168.180.64 sport=41975 dport=10019 [UNREPLIED] src=172.48.0.91 dst=192.168.177.3 sport=10019 dport=41975 mark=0 use=98
conntrack v1.4.6 (conntrack-tools): 1 flow entries have been deleted.

$ sudo conntrack -L | grep "10019"
udp      17 29 src=192.168.177.3 dst=192.168.180.64 sport=41975 dport=10019 [UNREPLIED] src=172.48.0.93 dst=192.168.177.3 sport=10019 dport=41975 mark=0 use=1
conntrack v1.4.6 (conntrack-tools): 219 flow entries have been shown.```

[brandond]

This is managed by kube-proxy, which is part of core Kubernetes and not unique to K3s. See upstream issue:

• Implement a kube-proxy conntrack reconciler kubernetes/kubernetes#126130

[dynek]

Many thanks! 👍🏻