Contour controller pod continuously restarting due to OOMKilled

Products

• VMware vSphere Kubernetes Service

Issue/Introduction

• Contour management/controller pods within VKr clusters continuously restart with an OOMKilled status.
• Increasing memory limits (e.g., from 128Mi to 512Mi) only increases the time between crashes rather than preventing them.
• Logs show a high number of "open watch" events in the edsCache without corresponding "close" events.
• Error logs may also show unresolved service reference (e.g., service "vault/ssl-redirect" not found), which accelerates the leak by triggering frequent xDS updates.

Environment

VKr 1.2X 7 1.3X
Contour 1.33 and prior versions

Cause

A critical bug exists in the LinearCache implementation within the go-control-plane library (v0.13.4) used by Contour v1.32.x.
State-of-the-World (SotW) non-wildcard watches are not properly cleaned up after being replied to Envoy, leading to a linear memory growth as new watches are opened.

Resolution

• Primary Fix: Upgrade Contour to version 1.33.3 or newer. These versions include go-control-plane v0.14.0+, which contains the fix for the watch cleanup leak.
• Workaround/Mitigation: Resolve any "unresolved service reference" errors in the configuration to reduce the frequency of xDS updates, which will slow the rate of the memory leak until an upgrade is performed.

Additional Information

See the following github referencing the Contour issue and resoluton: [sotw][linear] Fix missing watch cleanup in linear cache for sotw watches subscribing to multiple resources