Change:
if err != nil { framework.Failf("error waiting for pod %s to be unready %v", webserverPod0.Name, err) } <del> // Wait the change has been propagated and the service start to fail clusterIPAddress := net.JoinHostPort(svc.Spec.ClusterIP, strconv.Itoa(servicePort)) cmd := fmt.Sprintf(`curl -q -s --connect-timeout 5 %s/hostname`, clusterIPAddress) if pollErr := wait.PollImmediate(framework.Poll, e2eservice.KubeProxyEndpointLagTimeout, func() (bool, error) { </del> <ins> nodeIPs0 := e2enode.GetAddresses(&node0, v1.NodeInternalIP) nodeIPs1 := e2enode.GetAddresses(&node1, v1.NodeInternalIP) nodePortAddress0 := net.JoinHostPort(nodeIPs0[0], strconv.Itoa(int(svc.Spec.Ports[0].NodePort))) nodePortAddress1 := net.JoinHostPort(nodeIPs1[0], strconv.Itoa(int(svc.Spec.Ports[0].NodePort))) // Wait until the change has been propagated to both nodes. cmd := fmt.Sprintf(`curl -q -s --connect-timeout 5 %s/hostname`, nodePortAddress0) if pollErr := wait.PollUntilContextTimeout(ctx, framework.Poll, e2eservice.KubeProxyEndpointLagTimeout, true, func(_ context.Context) (bool, error) { _, err := e2eoutput.RunHostCmd(pausePod1.Namespace, pausePod1.Name, cmd) if err != nil { return true, nil } return false, nil }); pollErr != nil { framework.ExpectNoError(pollErr, "pod on node0 still serves traffic") } cmd = fmt.Sprintf(`curl -q -s --connect-timeout 5 %s/hostname`, nodePortAddress1) if pollErr := wait.PollUntilContextTimeout(ctx, framework.Poll, e2eservice.KubeProxyEndpointLagTimeout, true, func(_ context.Context) (bool, error) { </ins> _, err := e2eoutput.RunHostCmd(pausePod1.Namespace, pausePod1.Name, cmd) if err != nil { return true, nil } return false, nil }); pollErr != nil { <del> framework.ExpectNoError(pollErr, "service still serves traffic") </del> <ins> framework.ExpectNoError(pollErr, "pod on node1 still serves traffic") </ins> } <del> nodeIPs0 := e2enode.GetAddresses(&node0, v1.NodeInternalIP) nodeIPs1 := e2enode.GetAddresses(&node1, v1.NodeInternalIP) nodePortAddress0 := net.JoinHostPort(nodeIPs0[0], strconv.Itoa(int(svc.Spec.Ports[0].NodePort))) nodePortAddress1 := net.JoinHostPort(nodeIPs1[0], strconv.Itoa(int(svc.Spec.Ports[0].NodePort))) </del> <ins> clusterIPAddress := net.JoinHostPort(svc.Spec.ClusterIP, strconv.Itoa(servicePort)) </ins> // connect 3 times every 5 seconds to the Service and expect a failure for i := 0; i < 5; i++ { cmd = fmt.Sprintf(`curl -q -s --connect-timeout 5 %s/hostname`, clusterIPAddress)

Discussion:
also see it flaky in /kind flake /sig network
This issue is currently awaiting triage. If a SIG or subproject determines this is a relevant issue, they will accept it by applying the label and provide further guidance. The label can be by org members by writing in a comment. <detailsInstructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
hmm, it does not look well indeed , I don't have time immediately but appreciate if someone can do an analysis of one of the failures /cc
failing jobs are not storing the kube-proxy logs, this is critical to solve ASAP or we are blind on failures
is merged to fix that. Let's wait for the next flake to happen.
Got 1 in the kube-proxy log is available
ok, this goes this way The only verifies that the change has been propagated to the specific node where that is tested , however, later we test nodePorts on different nodes, and kube-proxies in different nodes have different propagation times See The test pod runs in bootstrap-e2e-minion-group-sdr1, that is 10.138.0.6 138.0.3 is bootstrap-e2e-minion-group-v9j8, if we check , we can observe that the service is not processed until 3 seconds later than the check 00:39:09 vs 00:39:06 The solution is to validate on both nodes we are doing the check that kube-proxy has programmed the rules, or just validate one node Important, kube-proxy on gce jobs has a 10s period sync delay, so changes are accumulated during that period of 10s and flushed at same time to improve scale
/help
This request has been marked as needing help from a contributor. Please ensure that the issue body includes answers to the following questions: Why are we solving this issue? To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points? Does this issue have zero to low barrier of entry? How can the assignee reach out to you for help? For more details on the requirements of such an issue, please see and ensure that they are met.

If this request no longer meets these requirements, the label can be removed by commenting with the command. <detailsIn response to : /help Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
/assign
Hi! I would like to help with this. For now, I am trying to understand how the test works, but I don’t get something. So two pod configurations are created, one with a webserver and one with an agn image. The first one is assigned to node0 and the second one to node1. From the agn pod, which is on node1, curls are done to node0 to the webserver: First with clusterIPaddres:Second with the nodePortAddress0 But why is the third one needed? Isn’t this a curl from the pod from node0 to itself? Is this relevant to the test? Or am I missing something?
to exercise that it works from same node to cluster ip, same node to nodeport, node to nodeport on other node Those are different paths
I made a PR. When you have a moment to check it, let me know if it's okay or if anything needs to be modified. Thank you!