OCPBUGS-62295: Shorten HAProxy timeouts #5312
Conversation
We have a bug where misbehaved clients are exhausting the connection limits by starting a connection and abandoning it before it is even established. Setting the client-fin timeout is a recommended option to address this sort of situation. This patch also sets server-fin in the interest of symmetry and avoiding any similar issues on the server side.
I'm not sure why we set these to 24 hours in the first place, but it doesn't match what we document in our sample UPI HAProxy config, nor can I find any justification for why one would want such long timeouts. This changes our client and server timeouts to be 1m, matching the documented values. It also sets the tunnel timeout to 5m, which is not covered at all in the documentation but according to HAProxy docs should generally be longer than other timeouts since tunnel connection tend to be longer lived.
openshift-ci
bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
openshift-ci-robot
added
jira/valid-reference
|
@cybertron: This pull request references Jira Issue OCPBUGS-62295, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
Requesting review from QA contact: The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
This should merge after #5310 to avoid issues with backporting that PR. |
|
/verified by @rbbratta |
openshift-ci-robot
added
the
verified
|
@rbbratta: This PR has been marked as verified by In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
#5310 has merged so this is ready to go. |
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
|
@cybertron: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: cybertron, mkowalski The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
4 participants
I'm not sure why we set these to 24 hours in the first place, but
it doesn't match what we document in our sample UPI HAProxy config,
nor can I find any justification for why one would want such long
timeouts. This changes our client and server timeouts to be 1m,
matching the documented values. It also sets the tunnel timeout to
5m, which is not covered at all in the documentation but according
to HAProxy docs should generally be longer than other timeouts since
tunnel connection tend to be longer lived.
- What I did
- How to verify it
- Description for the changelog