Port-forward still drops connection after first to PostgreSQL pod in SSL Mode.

[xqe2011]

This issue still persists in v1.33.1, and ?sslmode=disable is still a solution.

Client Version: v1.33.1
Server Version: v1.31.7+rke2r1
PostgresQL Version: 17.4 (Debian 17.4-1.pgdg120+2), managed by CloudNativePG

Originally posted by @xqe2011 in #1169

This bug will affect IDEA Kubernetes plugin or any application that tries to establish multiple SSL connections to the same database. Should we reopen the original issue?

[ardaguclu]

port-forward command has moved to websocket from SPDY. I think we need more data or log to figure out what is the issue. Could you please paste some logs after running the command with -v=9.

[xqe2011]

OK, I can provide masked logs.

disconnect.log

[mpuckett159]

/triage accepted

[Hazmi35]

Can confirm this is also affecting Jetbrains Datagrip

[soltysh]

@xqe2011 the fixes that landed in kubernetes/kubernetes#128318 and later in kubernetes/kubernetes#128681 required these changes be also propagated to CRIs. I'm certain that newer versions of CRIO 1.32+ and Containerd 2.0+ should have the first patch applied (they vendor that piece of code). Can you check which exact version of crio or containerd you have there?

[xqe2011]

I am using containerd.

# crictl version
Version:  0.1.0
RuntimeName:  containerd
RuntimeVersion:  v2.0.4-k3s2
RuntimeApiVersion:  v1

[Hazmi35]

This could be related with kubernetes/kubernetes#111825

[lpopil]

Hey @soltysh

According to @xqe2011 comment issue exists on containerd v2.0.4.
I can confirm the same problem is reproducible with containerd v2.1.5 as well.

containerd v1.7.15 and probably higher - no issues.

Best,
Liubomyr

[mikkeldamsgaard]

Hey @soltysh

I have conducted some tests today and the results could be interesting. I am running k8s@1.33.6 and containerd@2.2.0

First of I disabled websockets for port forwarding with the feature gate flag (PortForwardWebsockets) on the client side and the connection was verified being established without the use of websockets via the detailed logs. However the problem was still present. That would suggest this is then not related to websockets/SPDY, but more towards the containerd version.

Then I tried with k8s@1.33.6 and containerd@1.7.29 and that works without any issues with both websockets and SPDY.

Kind regards,
Mikkel