[firecow]

After a cilium-envoy restart the L7 listeners start accepting connections before the first NetworkPolicy update is installed, so a connection accepted in that window gets no policy filter state and every request on it answers 500 for as long as the client keeps it open, which this fixes by holding each listener's initialization until the first policy update is installed, or for at most 5 seconds so a stalled policy stream cannot keep listeners down.

[moberghammer]

👍🏻

[jrajahalme]

@firecow Did you verify that the Listener init manager wait on policy update meaningfully changes behavior? The wait delays both listener socket listen() and accept() calls, so clients could get connection refused responses instead during the wait window.

Also, please squash commits as we don't do that automatically on merge :-)

[nezdolik]

+1 on @jrajahalme point
@firecow so which response code would client get while listener initialization is postponed waiting on policy update?

[jrajahalme]

Also needs rebasing due to conflict with main due to #2056.

[firecow]

@jrajahalme @nezdolik Yes. On minikube with Cilium main and cilium-envoy from this branch, plus a 3 s sleep before the first NPDS update to widen the window, a keep-alive connection opened in the window got 500 on every request for the whole test without this change, and 200 with it.

Neither build gave connection refused. While no listener is accepting, the client's connect just stalls until the listener starts, as it already does during a cilium-envoy restart. The change extends that by the time until the first policy update, so a connect may wait one TCP retransmit longer instead of succeeding and then failing every request.