Context deadline exceeded on RG GET

[CecileRobertMichon]

/kind bug

[Before submitting an issue, have you checked the Troubleshooting Guide?]

Observed in PR #1711, repro'ed locally:

E1201 19:33:57.222382      38 controller.go:317] controller/azurecluster "msg"="Reconciler error" "error"="failed to reconcile cluster services: failed to reconcile resource group: failed to create resource cecile-9211/cecile-9211 (service: group): failed to get desired parameters for group cecile-9211: failed to get RG cecile-9211: resources.GroupsClient#Get: Failure sending request: StatusCode=0 -- Original Error: context deadline exceeded" "name"="cecile-9211" "namespace"="default" "reconciler group"="infrastructure.cluster.x-k8s.io" "reconciler kind"="AzureCluster" 

Anything else you would like to add:
[Miscellaneous information that will assist in solving the issue.]

Environment:

• cluster-api-provider-azure version:
• Kubernetes version: (use kubectl version):
• OS (e.g. from /etc/os-release):

[CecileRobertMichon]

/assign

[CecileRobertMichon]

Interestingly it seems like the RG GET is actually timing out after 12 seconds. I wouldn't expect an Azure GET API to take 12 seconds.... cc @devigned @Jont828

[devigned]

Interestingly it seems like the RG GET is actually timing out after 12 seconds. I wouldn't expect an Azure GET API to take 12 seconds.... cc @devigned @Jont828

This looks like it's talking to IMDS IP rather than ARM. Are you sure it's not AAD pod identity / IMDS exceeding 12 seconds?

[CecileRobertMichon]

sorry for the tag, I just pasted the comment here yesterday because I realized I had previously put it in the wrong issue...

[CecileRobertMichon]

From a separate investigation (slack thread) this error seems to occur when pod identity is not able to fetch the token from IMDS under 12 seconds, possibly because the token is not valid. It's not ideal that it doesn't return an error and just times out, there might be a way to improve the logging when this happens so the user knows it's a problem with their client id/secret.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle stale
• Mark this issue or PR as rotten with /lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Close this issue or PR with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue or PR with /reopen
• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue.

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue or PR with /reopen
• Mark this issue or PR as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[yastij]

/reopen

@CecileRobertMichon - we've been seeing similar issues at the infra/machine level (through conditions):

message:'inboundnatrules failed to create or update. err: failed to get existing NAT rules: could not list inbound NAT rules for load balancer upgrade-9599mgmt-azure-public-lb: network.InboundNatRulesClient#List: Failure sending request: StatusCode=0 -- Original Error: context deadline exceeded'

kubernetes version update failed, reason:'DeletionFailed @ Machine/upgrade-9601azure-antrea-control-plane-jwwl9', message:'interfaces failed to delete. err: failed to delete resource xxxxxx (service: interfaces): network.InterfacesClient#Delete: Failure sending request: StatusCode=0 -- Original Error: context deadline exceeded' 

these clusters are still relying aad-pod-identity, not sure if that's reproducible with workload identity

[k8s-ci-robot]

@yastij: Reopened this issue.

In response to this:

/reopen

@CecileRobertMichon - we've been seeing similar issues at the infra/machine level:

message:'inboundnatrules failed to create or update. err: failed to get existing NAT rules: could not list inbound NAT rules for load balancer upgrade-9599mgmt-azure-public-lb: network.InboundNatRulesClient#List: Failure sending request: StatusCode=0 -- Original Error: context deadline exceeded'

kubernetes version update failed, reason:'DeletionFailed @ Machine/upgrade-9601azure-antrea-control-plane-jwwl9', message:'interfaces failed to delete. err: failed to delete resource xxxxxx (service: interfaces): network.InterfacesClient#Delete: Failure sending request: StatusCode=0 -- Original Error: context deadline exceeded' 

these clusters are still relying aad-pod-identity, not sure if that's reproducible with workload identity

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-triage-robot]

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

[k8s-ci-robot]

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Reopen this issue with /reopen
• Mark this issue as fresh with /remove-lifecycle rotten
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.