[sig-api-machinery] webhook related test about kubernetes

[k8s-ci-robot]

There are no sig labels on this issue. Please add an appropriate label by using one of the following commands:

• /sig <group-name>
• /wg <group-name>
• /committee <group-name>

Please see the group list for a listing of the SIGs, working groups, and committees available.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-ci-robot]

This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[spyroot]

I'm closing this case. For the rest, HTTP/2 uses a max segment size in the case of jumbo MTU, i.e., if you have some issue with MTU and a network configured with jumbo MTU. Still, you have slightly less than sufficient offset for overhead, i.e., in the case of some sort of bridge or tunnel, the frame size might exceed, so SYN-ACK never happened. Hence, kube-api webhooks never establish a TLS connection that uses HTTP/2.

I would say the recommended action is to create pods in the Kube system and check MTU at full mtu size to confirm that there is no issue on the network side with jumbo mtu, etc.

b) I still need confirmation, but it looked like PMTU does not work in case you have a bridge interface and uplink some sort of tunnel ( VXLAN, Geneve, etc). Hence, PMTU never kicks in, so SYN-ACK is never completed.

[spyroot]

I'm closing this case. For the rest, HTTP/2 uses a max segment size in the case of jumbo MTU, i.e., if you have some issue with MTU and a network configured with jumbo MTU. Still, you have slightly less than sufficient offset for overhead, i.e., in the case of some sort of bridge or tunnel, the frame size might exceed, so SYN-ACK never happened. Hence, kube-api webhooks never establish a TLS connection that uses HTTP/2.

I would say the recommended action is to create pods in the Kube system and check MTU at full mtu size to confirm that there is no issue on the network side with jumbo mtu, etc.

b) I still need confirmation, but it looks like PMTU does not work if you have a bridge interface and uplink some sort of tunnel ( VXLAN, Geneve, etc.). Hence, PMTU never kicks in, so SYN-ACK is never completed.