Change:
<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks! If the matter is security related, please disclose it privately via --What happened: kube-proxy doesn't validate the configurable IPVS tcp, tcpfin and udp timeouts. For example, when kube-proxy starts with , it will always log a warning: . What you expected to happen: kube-proxy should validate --ipvs-tcp-timeout, --ipvs-tcpfin-timeout, --ipvs-udp-timeout flag values at start. How to reproduce it (as minimally and precisely as possible): add flags to kube-proxy Anything else we need to know?: Environment: Kubernetes version (use ): Cloud provider or hardware configuration: OS (e.g: ): Kernel (e.g. ): Install tools: Network plugin and version (if this is a network-related bug): Others:
/sig network /area ipvs
/triage unresolved Comment when the issue is assessed and confirmed. I am a bot run by vllry. ‍

Discussion:
allErrs = append(allErrs, field.Invalid(fldPath.Child("SyncPeriod"), config.MinSyncPeriod, fmt.Sprintf("must be greater than or equal to %s", fldPath.Child("MinSyncPeriod").String()))) } <ins> allErrs = append(allErrs, validateIPVSTimeout(config, fldPath)...) </ins> allErrs = append(allErrs, validateIPVSSchedulerMethod(kubeproxyconfig.IPVSSchedulerMethod(config.Scheduler), fldPath.Child("Scheduler"))...) allErrs = append(allErrs, validateIPVSExcludeCIDRs(config.ExcludeCIDRs, fldPath.Child("ExcludeCidrs"))...)

return allErrs } <ins> func validateIPVSTimeout(config kubeproxyconfig.KubeProxyIPVSConfiguration, fldPath *field.Path) field.ErrorList { allErrs := field.ErrorList{} if config.TCPTimeout.Duration < 0 { allErrs = append(allErrs, field.Invalid(fldPath.Child("TCPTimeout"), config.TCPTimeout, "must be greater than or equal to 0")) } if config.TCPFinTimeout.Duration < 0 { allErrs = append(allErrs, field.Invalid(fldPath.Child("TCPFinTimeout"), config.TCPFinTimeout, "must be greater than or equal to 0")) } if config.UDPTimeout.Duration < 0 { allErrs = append(allErrs, field.Invalid(fldPath.Child("UDPTimeout"), config.UDPTimeout, "must be greater than or equal to 0")) } return allErrs } </ins> func validateIPVSExcludeCIDRs(excludeCIDRs []string, fldPath *field.Path) field.ErrorList { allErrs := field.ErrorList{}

}, expectErr: false, }, <ins> // IPVS Timeout can be 0 { config: kubeproxyconfig.KubeProxyIPVSConfiguration{ SyncPeriod:    metav1.Duration{Duration: 5 * time.Second}, TCPTimeout:    metav1.Duration{Duration: 0 * time.Second}, TCPFinTimeout: metav1.Duration{Duration: 0 * time.Second}, UDPTimeout:    metav1.Duration{Duration: 0 * time.Second}, }, expectErr: false, }, // IPVS Timeout > 0 { config: kubeproxyconfig.KubeProxyIPVSConfiguration{ SyncPeriod:    metav1.Duration{Duration: 5 * time.Second}, TCPTimeout:    metav1.Duration{Duration: 1 * time.Second}, TCPFinTimeout: metav1.Duration{Duration: 2 * time.Second}, UDPTimeout:    metav1.Duration{Duration: 3 * time.Second}, }, expectErr: false, }, // TCPTimeout Timeout < 0 { config: kubeproxyconfig.KubeProxyIPVSConfiguration{ SyncPeriod: metav1.Duration{Duration: 5 * time.Second}, TCPTimeout: metav1.Duration{Duration: -1 * time.Second}, }, expectErr: true, reason:    "TCPTimeout must be greater than or equal to 0", }, // TCPFinTimeout Timeout < 0 { config: kubeproxyconfig.KubeProxyIPVSConfiguration{ SyncPeriod:    metav1.Duration{Duration: 5 * time.Second}, TCPFinTimeout: metav1.Duration{Duration: -1 * time.Second}, }, expectErr: true, reason:    "TCPFinTimeout must be greater than or equal to 0", }, // UDPTimeout Timeout < 0 { config: kubeproxyconfig.KubeProxyIPVSConfiguration{ SyncPeriod: metav1.Duration{Duration: 5 * time.Second}, UDPTimeout: metav1.Duration{Duration: -1 * time.Second}, }, expectErr: true, reason:    "UDPTimeout must be greater than or equal to 0", }, </ins> } for _, test := range testCases {