Ingress-nginx: [Question] Concerns about the affinity module nginx-sticky-module-ng

[juliohm1978]

While nginx-ingress-controller is awesome in so many ways, our team has recently faced a few issues regarding load balance with the use of sticky sessions. This is not directly related to nginx-ingress itself, but the module it uses.

For context... We have a legacy environment currently using Nginx 1.15, custom compiled with the nginx-sticky-module-ng, which is the same used in the ingress-controller. We are also in the process of migrating our entire infrastructure into Kubernetes clusters, and a couple of those are up and running.

Stepping away from Kubernetes for a moment, we are facing a troublesome issue in our legacy with the sticky module, which causes Nginx to crash under high loads while having upstreams configured with shared memory zones.

We recently raised this issue with the Nginx team, but they are pointing fingers to the sticky module, stating:

_To work with upstreams in shared memory zone, all upstream-related modules involved needs to be compatible with such upstreams - use only standard structures, do proper locking and so on. As per the configuration and nginx -V output, you are using a 3rd party module, nginx-goodies-nginx-sticky-module-ng-08a395c66e42, which isn't compatible._

We are now tracking the issue in the module project at bitbucket, but the lack of activity in that project is worrisome. The last commit on that project was way back in 2016, and that raises significant concern about its maintenance.

As it stands, the nginx-ingress project is using a module that hasn't had a release in over 2 years. And this module seems to have a serious concurrency issues with shared memory zones under high loads.

So my question are about the plans to update this module. Maybe find an alternative with a more active community? I'm don't have an answer for this, but I woud like to raise this as relevant concern to this project. It may works well for small/medium environments, but its users need to be at least aware of these issues at large scale.

[aledbf]

So my question are about the plans to update this module. Maybe find an alternative with a more active community?

We are aware of the state of this module. This is one of the reasons why the new dynamic mode doesn't use it :wink: Instead, we use a LUA module for this now. Since 0.18.0 the dynamic module is enabled by default.

The plan is to remove the old model, which implies we could get rid of some NGINX modules from the image

[juliohm1978]

Very glad to hear that. Best regards!