For some reason, we are observing that the kube-apiserver opens some connections to the pods that server a mutating admission webhook (defined in a mutatingwebhookconfiguration) and then, all of a sudden, issues a TCP connection close right after having sent the TLS client hello (soon before or soon after having received the TLS server hello), i.e. it looks as if it opened connections for nothing, which are seen as "TLS handshake: EOF" errors on the webhook pod (because the TLS handshake cannot indeed be completed because the TCP connection ends too soon). Timing does not suggest that any timeout is reached.

We tried to make some sense from the kube-apiserver logs, tcpdump, strace... but we couldn't find anything, so we need help in reviewing whether this is normal or not and how to fix (if needed).

4.13.41

Sometimes

1. Observe pod-identity-webhook pod logs
2. (Optional) tcpdump and/or strace the kube-apiserver

TCP connections are opened and then closed suddenly during TLS handshake.

No strange (apparently useless) connections

In internal comments