From dc11f88c18c753d4f8b6a8505c740ecc713a9bef Mon Sep 17 00:00:00 2001 From: Weilu Jia Date: Fri, 26 Jun 2026 17:46:55 -0700 Subject: [PATCH] fix(orchestrator): log missing egress proxy in startup reclaim instead of defaulting silently --- packages/orchestrator/pkg/startupreclaim/reclaim.go | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/packages/orchestrator/pkg/startupreclaim/reclaim.go b/packages/orchestrator/pkg/startupreclaim/reclaim.go index e38b4a4971..94f355c46f 100644 --- a/packages/orchestrator/pkg/startupreclaim/reclaim.go +++ b/packages/orchestrator/pkg/startupreclaim/reclaim.go @@ -84,6 +84,16 @@ type reclaimer struct { func Run(ctx context.Context, config Config) Summary { config = config.withDefaults() + + // No egress proxy wired: slots are still torn down, but the egress firewall + // cleanup (OnSlotDelete) is skipped and those iptables rules may leak. Log it + // instead of substituting silently; callers with no egress firewall can pass + // network.NewNoopEgressProxy() to opt in quietly. + if config.EgressProxy == nil { + logger.L().Error(ctx, "startup reclaim: no egress proxy provided; egress firewall cleanup will be skipped for reclaimed slots") + config.EgressProxy = network.NewNoopEgressProxy() + } + summary := Summary{Reclaimed: map[string]int{}, Failed: map[string]int{}} // Order matters: firecracker runs first so the VMMs are killed before the @@ -137,9 +147,6 @@ func (c Config) withDefaults() Config { if c.CgroupRoot == "" { c.CgroupRoot = cgroup.RootCgroupPath } - if c.EgressProxy == nil { - c.EgressProxy = network.NewNoopEgressProxy() - } return c }