Unexpected service selector update after update of labels for envoy pods

[Hartigan]

Description:
When labels defined in EnvoyProxy resource for envoy pods, they also updated in kubernetes Service selector. This behavior cause downtime when any labels added or changed for envoy pods in EnvoyProxy resource, because selector in service updates instantly, but update of Deployment require time for rollout update.

Repro steps:

1. Add label for envoy pod in EnvoyProxy;
2. Notice change in Service selector;

Environment:
It's reproducible on 1.5.4, but I believe it's introduced earlier

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days.

[sergeyshevch]

Not stale. It caused large downtime in our case

[zirain]

if we add same labels that won't be copied to Service, what about using patch instead?

[Hartigan]

Hi @zirain
Actually, I'm not seeking for workaround, but for discussion about change of API/docs to make it safe. Current API for changing labels for EnvoyProxy pods not safe, because introduces disruption in basic use cases. Some options which can solve this problem:

• Allow to change selector for EnvoyProxy resource independently from pods labels;
• Describe this use case in docs and mark this property dangerous.

[sergeyshevch]

@Hartigan Thanks for your comment. It's exact our case. We got downtime after changing labels here

[zirain]

@Hartigan yes, that's right, we should either change the implement or highlight the dangerous.

[github-actions]

This issue has been automatically marked as stale because it has not had activity in the last 30 days.