Merge pull request #22423 from wojtek-t/increase_qps_for_admission_control

cmd/kube-apiserver/app/server.go

@@ -256,6 +256,11 @@ func Run(s *options.APIServer) error {
 
 	clientConfig := &restclient.Config{
 		Host: net.JoinHostPort(s.InsecureBindAddress.String(), strconv.Itoa(s.InsecurePort)),
+		// Increase QPS limits. The client is currently passed to all admission plugins,
+		// and those can be throttled in case of higher load on apiserver - see #22340 and #22422
+		// for more details. Once #22422 is fixed, we may want to remove it.
+		QPS:   50,
+		Burst: 100,
 	}
 	if len(s.DeprecatedStorageVersion) != 0 {
 		gv, err := unversioned.ParseGroupVersion(s.DeprecatedStorageVersion)

plugin/pkg/admission/limitranger/admission.go

@@ -103,6 +103,11 @@ func (l *limitRanger) Admit(a admission.Attributes) (err error) {
 	if len(items) == 0 {
 		lruItemObj, ok := l.liveLookupCache.Get(a.GetNamespace())
 		if !ok || lruItemObj.(liveLookupEntry).expiry.Before(time.Now()) {
+			// TODO: If there are multiple operations at the same time and cache has just expired,
+			// this may cause multiple List operations being issued at the same time.
+			// If there is already in-flight List() for a given namespace, we should wait until
+			// it is finished and cache is updated instead of doing the same, also to avoid
+			// throttling - see #22422 for details.
 			liveList, err := l.client.Core().LimitRanges(a.GetNamespace()).List(api.ListOptions{})
 			if err != nil {
 				return admission.NewForbidden(a, err)

plugin/pkg/admission/resourcequota/admission.go

@@ -128,6 +128,11 @@ func (q *quotaAdmission) Admit(a admission.Attributes) (err error) {
 	if len(items) == 0 {
 		lruItemObj, ok := q.liveLookupCache.Get(a.GetNamespace())
 		if !ok || lruItemObj.(liveLookupEntry).expiry.Before(time.Now()) {
+			// TODO: If there are multiple operations at the same time and cache has just expired,
+			// this may cause multiple List operations being issued at the same time.
+			// If there is already in-flight List() for a given namespace, we should wait until
+			// it is finished and cache is updated instead of doing the same, also to avoid
+			// throttling - see #22422 for details.
 			liveList, err := q.client.Core().ResourceQuotas(namespace).List(api.ListOptions{})
 			if err != nil {
 				return admission.NewForbidden(a, err)