kubelet: Simplify rejected pod update logic

Signed-off-by: Pablo Acevedo Montserrat <pacevedo@redhat.com>

Author: pacevedom

pkg/kubelet/kubelet.go

@@ -2422,27 +2422,6 @@ func (kl *Kubelet) rejectPod(pod *v1.Pod, reason, message string) {
 		Message:  PodRejectionMessagePrefix + message})
 }
 
-// isLocallyRejected checks if a pod has already been rejected. These pods
-// have never had containers created, have a Failed phase and a specific
-// status that is forced by rejectPod() call. The only distinctive feature
-// they have from other pods is the presence of a specific status: empty
-// and having a message with the prefix PodRejectionMessagePrefix.
-// This function looks for the message in both statusManager (current
-// session rejection) and, if not found, in status from API server (rejection
-// that was already synced to the API in case of a kubelet restart).
-func (kl *Kubelet) isLocallyRejected(pod *v1.Pod) bool {
-	localStatus, found := kl.statusManager.GetPodStatus(pod.UID)
-	if found && strings.HasPrefix(localStatus.Message, PodRejectionMessagePrefix) {
-		return true
-	}
-
-	if strings.HasPrefix(pod.Status.Message, PodRejectionMessagePrefix) {
-		return true
-	}
-
-	return false
-}
-
 func recordAdmissionRejection(reason string) {
 	// It is possible that the "reason" label can have high cardinality.
 	// To avoid this metric from exploding, we create an allowlist of known
@@ -2797,15 +2776,14 @@ func (kl *Kubelet) HandlePodUpdates(pods []*v1.Pod) {
 		}
 
 		// Skip rejected pods during UPDATE operations.
-		//
-		// Pods always arrive as ADD before UPDATE (guaranteed by the config layer).
-		// If a pod failed admission in HandlePodAdditions, it was never sent to
-		// pod_workers and won't be known to the worker. UPDATE operations for such
-		// pods should be ignored because:
+		// Pods always arrive as ADD before UPDATE (enforced by the config layer).
+		// If a pod failed admission in HandlePodAdditions, it was rejected and
+		// never sent to pod_workers. UPDATE operations for such pods should be
+		// ignored because:
 		// 1. No containers exist - nothing to sync or clean up
 		// 2. The pod is already in terminal Failed state
 		// 3. REMOVE operation will eventually clean up podManager
-		if !kl.podWorkers.IsPodKnownToWorker(pod.UID) {
+		if kl.isLocallyRejected(pod) {
 			continue
 		}
 		kl.podWorkers.UpdatePod(UpdatePodOptions{

pkg/kubelet/kubelet_pods.go

@@ -1166,6 +1166,34 @@ func (kl *Kubelet) isAdmittedPodTerminal(pod *v1.Pod) bool {
 	return false
 }
 
+// isLocallyRejected checks if a pod was rejected by this kubelet instance.
+// Rejected pods are pods that failed admission (e.g., insufficient resources,
+// node affinity mismatch). These pods:
+// - Never had containers created
+// - Were marked as Failed with PodRejectionMessagePrefix in the status message
+// - Should never enter the pod_workers pipeline
+//
+// This function checks both the local statusManager cache (for current session
+// rejections) and the pod.Status from API server (for rejections that survived
+// kubelet restart).
+func (kl *Kubelet) isLocallyRejected(pod *v1.Pod) bool {
+	// Check local statusManager cache first (current session rejections).
+	// This catches pods rejected since the kubelet started.
+	localStatus, found := kl.statusManager.GetPodStatus(pod.UID)
+	if found && strings.HasPrefix(localStatus.Message, PodRejectionMessagePrefix) {
+		return true
+	}
+
+	// Check API server status (rejections from before kubelet restart).
+	// When kubelet restarts, the local statusManager is empty, but the rejection
+	// status was synced to the API server and is available in pod.Status.
+	if strings.HasPrefix(pod.Status.Message, PodRejectionMessagePrefix) {
+		return true
+	}
+
+	return false
+}
+
 // removeOrphanedPodStatuses removes obsolete entries in podStatus where
 // the pod is no longer considered bound to this node.
 func (kl *Kubelet) removeOrphanedPodStatuses(pods []*v1.Pod, mirrorPods []*v1.Pod) {

pkg/kubelet/pod_workers.go

@@ -183,13 +183,6 @@ type PodWorkers interface {
 	// Intended for use by the kubelet config loops, but not subsystems, which should
 	// use ShouldPod*().
 	IsPodKnownTerminated(uid types.UID) bool
-	// IsPodKnownToWorker returns true if the pod has ever been sent to the pod
-	// worker via UpdatePod (i.e., has an entry in podSyncStatuses). A pod that
-	// did not enter the pod worker pipeline is a pod that was rejected and
-	// therefore should not be processed. No containers exist for these pods
-	// and they are already in a terminal Failed state.
-	// Intended for use by the kubelet config loops, but not subsystems.
-	IsPodKnownToWorker(uid types.UID) bool
 	// CouldHaveRunningContainers returns true before the pod workers have synced,
 	// once the pod workers see the pod (syncPod could be called), and returns false
 	// after the pod has been terminated (running containers guaranteed stopped).
@@ -656,13 +649,6 @@ func (p *podWorkers) IsPodKnownTerminated(uid types.UID) bool {
 	return false
 }
 
-func (p *podWorkers) IsPodKnownToWorker(uid types.UID) bool {
-	p.podLock.Lock()
-	defer p.podLock.Unlock()
-	_, ok := p.podSyncStatuses[uid]
-	return ok
-}
-
 func (p *podWorkers) CouldHaveRunningContainers(uid types.UID) bool {
 	p.podLock.Lock()
 	defer p.podLock.Unlock()

pkg/kubelet/pod_workers_test.go

@@ -102,12 +102,6 @@ func (f *fakePodWorkers) IsPodKnownTerminated(uid types.UID) bool {
 	defer f.statusLock.Unlock()
 	return f.terminated[uid]
 }
-func (f *fakePodWorkers) IsPodKnownToWorker(uid types.UID) bool {
-	f.statusLock.Lock()
-	defer f.statusLock.Unlock()
-	// In tests, a pod is known if it's in any of the tracking maps
-	return f.running[uid] || f.terminating[uid] || f.terminated[uid]
-}
 func (f *fakePodWorkers) CouldHaveRunningContainers(uid types.UID) bool {
 	f.statusLock.Lock()
 	defer f.statusLock.Unlock()