High memory usage and pod eviction for Contour in Kubernetes 1.33+ clusters

Products

• VMware Tanzu Platform - Kubernetes

Issue/Introduction

• In development or production clusters running Kubernetes 1.33 or higher, Contour pods may experience excessive memory consumption, typically reaching approximately 3.5 GB or higher.
• This high memory footprint leads to the following symptoms:
  
  
  • Contour pods enter an Evicted state.
  • kubectl describe pod shows: The node was low on resource: memory. Threshold quantity: 100Mi, available: <value>.
  • Contour logs explicitly capture recurring warnings from the Kubernetes API server: "v1 Endpoints is deprecated in v1.33+; use discovery.k8s.io/v1 EndpointSlice".

Environment

VMware vSphere Kubernetes Service

Cause

The issue is caused by a version mismatch between the Contour package and the Kubernetes API. Contour 1.28.2 and lower versions utilize the legacy v1.Endpoints API. In Kubernetes 1.33+, this legacy API triggers a "fan-out" serialization overhead when pushing endpoint updates to multiple Envoy replicas (e.g., 15+ replicas). The resulting memory spike exceeds the pod's resource limits or the node's available memory, triggering the Kubelet eviction process.

Resolution

Upgrade the Contour package to version 1.30 or higher which is compatible with Kubernetes 1.33+ clusters, and, supports the more efficient EndpointSlice API.

Additional Information

• Refer to the steps in the document "Managing VKS Standard Packages" to upgrade the Contour package.
  
  
• Ensure the environment meets the requirements for Contour 1.30+. Refer to the VKS Standard Packages Release Notes for compatibility between Contour package and Kubernetes cluster.