Skip to content

Commit 0952bf6

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #2584 from alebedev87/OCPBUGS-60885-abortonclose
OCPBUGS-60885: Add ClosedClientConnectionPolicy to IngressController API
2 parents 32e27fc + d515516 commit 0952bf6

File tree

10 files changed

+193
-0
lines changed

10 files changed

+193
-0
lines changed

‎openapi/generated_openapi/zz_generated.openapi.go‎

Lines changed: 8 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎operator/v1/tests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ tests:
1414
spec:
1515
httpEmptyRequestsPolicy: Respond
1616
idleConnectionTerminationPolicy: Immediate
17+
closedClientConnectionPolicy: Continue
1718
- name: Should be able to create an IngressController with valid Actions
1819
initial: |
1920
apiVersion: operator.openshift.io/v1
@@ -75,6 +76,7 @@ tests:
7576
spec:
7677
httpEmptyRequestsPolicy: Respond
7778
idleConnectionTerminationPolicy: Immediate
79+
closedClientConnectionPolicy: Continue
7880
httpHeaders:
7981
actions:
8082
response:
@@ -497,6 +499,7 @@ tests:
497499
spec:
498500
httpEmptyRequestsPolicy: Respond
499501
idleConnectionTerminationPolicy: Immediate
502+
closedClientConnectionPolicy: Continue
500503
tuningOptions:
501504
connectTimeout: 10s
502505
- name: Should be able to create an IngressController with valid composite connect timeout
@@ -518,6 +521,7 @@ tests:
518521
spec:
519522
httpEmptyRequestsPolicy: Respond
520523
idleConnectionTerminationPolicy: Immediate
524+
closedClientConnectionPolicy: Continue
521525
tuningOptions:
522526
connectTimeout: 100ms300μs
523527
- name: Should be able to create an IngressController with valid fraction connect timeout
@@ -539,6 +543,7 @@ tests:
539543
spec:
540544
httpEmptyRequestsPolicy: Respond
541545
idleConnectionTerminationPolicy: Immediate
546+
closedClientConnectionPolicy: Continue
542547
tuningOptions:
543548
connectTimeout: 1.5m
544549
- name: Should not be able to create an IngressController with invalid unit connect timeout
@@ -582,6 +587,7 @@ tests:
582587
spec:
583588
httpEmptyRequestsPolicy: Respond
584589
idleConnectionTerminationPolicy: Immediate
590+
closedClientConnectionPolicy: Continue
585591
tuningOptions:
586592
httpKeepAliveTimeout: 10s
587593
- name: Should be able to create an IngressController with valid composite httpKeepAlive timeout
@@ -603,6 +609,7 @@ tests:
603609
spec:
604610
httpEmptyRequestsPolicy: Respond
605611
idleConnectionTerminationPolicy: Immediate
612+
closedClientConnectionPolicy: Continue
606613
tuningOptions:
607614
httpKeepAliveTimeout: 100s300ms
608615
- name: Should be able to create an IngressController with valid fraction httpKeepAlive timeout
@@ -624,6 +631,7 @@ tests:
624631
spec:
625632
httpEmptyRequestsPolicy: Respond
626633
idleConnectionTerminationPolicy: Immediate
634+
closedClientConnectionPolicy: Continue
627635
tuningOptions:
628636
httpKeepAliveTimeout: 1.5m
629637
- name: Should not be able to create an IngressController with invalid unit httpKeepAlive timeout
@@ -688,6 +696,7 @@ tests:
688696
spec:
689697
httpEmptyRequestsPolicy: Respond
690698
idleConnectionTerminationPolicy: Immediate
699+
closedClientConnectionPolicy: Continue
691700
domain: "this-label-has-exactly-63-characters-validating-at-the-boundary.com"
692701
- name: Should not be able to create an IngressController with invalid domain
693702
initial: |
@@ -761,6 +770,7 @@ tests:
761770
spec:
762771
httpEmptyRequestsPolicy: Respond
763772
idleConnectionTerminationPolicy: Immediate
773+
closedClientConnectionPolicy: Continue
764774
domain: "123-foo.com"
765775
- name: Should not be able to update already invalid domain to another invalid domain
766776
initialCRDPatches:
@@ -817,5 +827,6 @@ tests:
817827
spec:
818828
httpEmptyRequestsPolicy: Respond
819829
idleConnectionTerminationPolicy: Immediate
830+
closedClientConnectionPolicy: Continue
820831
domain: "*.foo.com"
821832
replicas: 3

‎operator/v1/tests/ingresscontrollers.operator.openshift.io/IngressControllerLBOpenStack.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ tests:
2020
spec:
2121
httpEmptyRequestsPolicy: Respond
2222
idleConnectionTerminationPolicy: Immediate
23+
closedClientConnectionPolicy: Continue
2324
endpointPublishingStrategy:
2425
type: LoadBalancerService
2526
loadBalancer:
@@ -44,6 +45,7 @@ tests:
4445
spec:
4546
httpEmptyRequestsPolicy: Respond
4647
idleConnectionTerminationPolicy: Immediate
48+
closedClientConnectionPolicy: Continue
4749
endpointPublishingStrategy:
4850
type: LoadBalancerService
4951
loadBalancer:
@@ -70,6 +72,7 @@ tests:
7072
spec:
7173
httpEmptyRequestsPolicy: Respond
7274
idleConnectionTerminationPolicy: Immediate
75+
closedClientConnectionPolicy: Continue
7376
endpointPublishingStrategy:
7477
type: LoadBalancerService
7578
loadBalancer:

‎operator/v1/tests/ingresscontrollers.operator.openshift.io/IngressControllerLBSubnetsAWS.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ tests:
2929
spec:
3030
httpEmptyRequestsPolicy: Respond
3131
idleConnectionTerminationPolicy: Immediate
32+
closedClientConnectionPolicy: Continue
3233
endpointPublishingStrategy:
3334
type: LoadBalancerService
3435
loadBalancer:
@@ -71,6 +72,7 @@ tests:
7172
spec:
7273
httpEmptyRequestsPolicy: Respond
7374
idleConnectionTerminationPolicy: Immediate
75+
closedClientConnectionPolicy: Continue
7476
endpointPublishingStrategy:
7577
type: LoadBalancerService
7678
loadBalancer:
@@ -185,6 +187,7 @@ tests:
185187
spec:
186188
httpEmptyRequestsPolicy: Respond
187189
idleConnectionTerminationPolicy: Immediate
190+
closedClientConnectionPolicy: Continue
188191
endpointPublishingStrategy:
189192
type: LoadBalancerService
190193
loadBalancer:
@@ -476,6 +479,7 @@ tests:
476479
spec:
477480
httpEmptyRequestsPolicy: Respond
478481
idleConnectionTerminationPolicy: Immediate
482+
closedClientConnectionPolicy: Continue
479483
endpointPublishingStrategy:
480484
type: LoadBalancerService
481485
loadBalancer:
@@ -534,6 +538,7 @@ tests:
534538
spec:
535539
httpEmptyRequestsPolicy: Respond
536540
idleConnectionTerminationPolicy: Immediate
541+
closedClientConnectionPolicy: Continue
537542
endpointPublishingStrategy:
538543
type: LoadBalancerService
539544
loadBalancer:
@@ -584,6 +589,7 @@ tests:
584589
spec:
585590
httpEmptyRequestsPolicy: Respond
586591
idleConnectionTerminationPolicy: Immediate
592+
closedClientConnectionPolicy: Continue
587593
endpointPublishingStrategy:
588594
type: LoadBalancerService
589595
loadBalancer:

‎operator/v1/tests/ingresscontrollers.operator.openshift.io/SetEIPForNLBIngressController+IngressControllerLBSubnetsAWS.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ tests:
1414
spec:
1515
httpEmptyRequestsPolicy: Respond
1616
idleConnectionTerminationPolicy: Immediate
17+
closedClientConnectionPolicy: Continue
1718
- name: Should not allow ingress controller creation if sum of number subnets name and id provided is not equal to the number of eipAllocations.
1819
initial: |
1920
apiVersion: operator.openshift.io/v1
@@ -125,6 +126,7 @@ tests:
125126
spec:
126127
httpEmptyRequestsPolicy: Respond
127128
idleConnectionTerminationPolicy: Immediate
129+
closedClientConnectionPolicy: Continue
128130
endpointPublishingStrategy:
129131
loadBalancer:
130132
dnsManagementPolicy: Managed
@@ -180,6 +182,7 @@ tests:
180182
spec:
181183
httpEmptyRequestsPolicy: Respond
182184
idleConnectionTerminationPolicy: Immediate
185+
closedClientConnectionPolicy: Continue
183186
endpointPublishingStrategy:
184187
loadBalancer:
185188
dnsManagementPolicy: Managed
@@ -234,6 +237,7 @@ tests:
234237
spec:
235238
httpEmptyRequestsPolicy: Respond
236239
idleConnectionTerminationPolicy: Immediate
240+
closedClientConnectionPolicy: Continue
237241
endpointPublishingStrategy:
238242
loadBalancer:
239243
dnsManagementPolicy: Managed

‎operator/v1/tests/ingresscontrollers.operator.openshift.io/SetEIPForNLBIngressController.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ tests:
1414
spec:
1515
httpEmptyRequestsPolicy: Respond
1616
idleConnectionTerminationPolicy: Immediate
17+
closedClientConnectionPolicy: Continue
1718
- name: Should allow to set NLB parameters when LBType is NLB.
1819
initial: |
1920
apiVersion: operator.openshift.io/v1
@@ -43,6 +44,7 @@ tests:
4344
spec:
4445
httpEmptyRequestsPolicy: Respond
4546
idleConnectionTerminationPolicy: Immediate
47+
closedClientConnectionPolicy: Continue
4648
endpointPublishingStrategy:
4749
loadBalancer:
4850
dnsManagementPolicy: Managed
@@ -299,6 +301,7 @@ tests:
299301
spec:
300302
httpEmptyRequestsPolicy: Respond
301303
idleConnectionTerminationPolicy: Immediate
304+
closedClientConnectionPolicy: Continue
302305
endpointPublishingStrategy:
303306
loadBalancer:
304307
dnsManagementPolicy: Managed
@@ -321,6 +324,7 @@ tests:
321324
spec:
322325
httpEmptyRequestsPolicy: Respond
323326
idleConnectionTerminationPolicy: Immediate
327+
closedClientConnectionPolicy: Continue
324328
endpointPublishingStrategy:
325329
loadBalancer:
326330
dnsManagementPolicy: Managed

‎operator/v1/types_ingress.go‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -344,6 +344,47 @@ type IngressControllerSpec struct {
344344
// +kubebuilder:default:="Immediate"
345345
// +default="Immediate"
346346
IdleConnectionTerminationPolicy IngressControllerConnectionTerminationPolicy `json:"idleConnectionTerminationPolicy,omitempty"`
347+
348+
// closedClientConnectionPolicy controls how the IngressController
349+
// behaves when the client closes the TCP connection while the TLS
350+
// handshake or HTTP request is in progress. This option maps directly
351+
// to HAProxy’s "abortonclose" option.
352+
//
353+
// Valid values are: "Abort" and "Continue".
354+
// The default value is "Continue".
355+
//
356+
// When set to "Abort", the router will stop processing the TLS handshake
357+
// if it is in progress, and it will not send an HTTP request to the backend server
358+
// if the request has not yet been sent when the client closes the connection.
359+
//
360+
// When set to "Continue", the router will complete the TLS handshake
361+
// if it is in progress, or send an HTTP request to the backend server
362+
// and wait for the backend server's response, regardless of
363+
// whether the client has closed the connection.
364+
//
365+
// Setting "Abort" can help free CPU resources otherwise spent on TLS computation
366+
// for connections the client has already closed, and can reduce request queue
367+
// size, thereby reducing the load on saturated backend servers.
368+
//
369+
// Important Considerations:
370+
//
371+
// - The default policy ("Continue") is HTTP-compliant, and requests
372+
// for aborted client connections will still be served.
373+
// Use the "Continue" policy to allow a client to send a request
374+
// and then immediately close its side of the connection while
375+
// still receiving a response on the half-closed connection.
376+
//
377+
// - When clients use keep-alive connections, the most common case for premature
378+
// closure is when the user wants to cancel the transfer or when a timeout
379+
// occurs. In that case, the "Abort" policy may be used to reduce resource consumption.
380+
//
381+
// - Using RSA keys larger than 2048 bits can significantly slow down
382+
// TLS computations. Consider using the "Abort" policy to reduce CPU usage.
383+
//
384+
// +optional
385+
// +kubebuilder:default:="Continue"
386+
// +default="Continue"
387+
ClosedClientConnectionPolicy IngressControllerClosedClientConnectionPolicy `json:"closedClientConnectionPolicy,omitempty"`
347388
}
348389

349390
// httpCompressionPolicy turns on compression for the specified MIME types.
@@ -2170,3 +2211,34 @@ const (
21702211
// connection.
21712212
IngressControllerConnectionTerminationPolicyDeferred IngressControllerConnectionTerminationPolicy = "Deferred"
21722213
)
2214+
2215+
// IngressControllerClosedClientConnectionPolicy controls how the IngressController
2216+
// behaves when the client closes the TCP connection while the TLS
2217+
// handshake or HTTP request is in progress.
2218+
//
2219+
// +kubebuilder:validation:Enum=Abort;Continue
2220+
type IngressControllerClosedClientConnectionPolicy string
2221+
2222+
const (
2223+
// IngressControllerClosedClientConnectionPolicyAbort aborts processing early when the client
2224+
// closes the connection.
2225+
//
2226+
// This affects two types of processing: TLS handshake computation on the router
2227+
// and request handling.
2228+
//
2229+
// When the client closes the connection, the router will stop processing
2230+
// the TLS handshake, preventing unnecessary CPU work.
2231+
//
2232+
// If the HTTP request has not yet been sent to the backend, it will be aborted.
2233+
// If the request is already being processed by the backend, the router will
2234+
// half-close the connection to signal this condition to the backend server,
2235+
// which can then decide how to proceed.
2236+
IngressControllerClosedClientConnectionPolicyAbort IngressControllerClosedClientConnectionPolicy = "Abort"
2237+
2238+
// IngressControllerClosedClientConnectionPolicyContinue continues processing even if the client
2239+
// closes the connection.
2240+
//
2241+
// The router will complete the TLS handshake and wait for the backend
2242+
// server's response regardless of the client having closed the connection.
2243+
IngressControllerClosedClientConnectionPolicyContinue IngressControllerClosedClientConnectionPolicy = "Continue"
2244+
)

‎operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers.crd.yaml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,48 @@ spec:
109109
- clientCA
110110
- clientCertificatePolicy
111111
type: object
112+
closedClientConnectionPolicy:
113+
default: Continue
114+
description: |-
115+
closedClientConnectionPolicy controls how the IngressController
116+
behaves when the client closes the TCP connection while the TLS
117+
handshake or HTTP request is in progress. This option maps directly
118+
to HAProxy’s "abortonclose" option.
119+
120+
Valid values are: "Abort" and "Continue".
121+
The default value is "Continue".
122+
123+
When set to "Abort", the router will stop processing the TLS handshake
124+
if it is in progress, and it will not send an HTTP request to the backend server
125+
if the request has not yet been sent when the client closes the connection.
126+
127+
When set to "Continue", the router will complete the TLS handshake
128+
if it is in progress, or send an HTTP request to the backend server
129+
and wait for the backend server's response, regardless of
130+
whether the client has closed the connection.
131+
132+
Setting "Abort" can help free CPU resources otherwise spent on TLS computation
133+
for connections the client has already closed, and can reduce request queue
134+
size, thereby reducing the load on saturated backend servers.
135+
136+
Important Considerations:
137+
138+
- The default policy ("Continue") is HTTP-compliant, and requests
139+
for aborted client connections will still be served.
140+
Use the "Continue" policy to allow a client to send a request
141+
and then immediately close its side of the connection while
142+
still receiving a response on the half-closed connection.
143+
144+
- When clients use keep-alive connections, the most common case for premature
145+
closure is when the user wants to cancel the transfer or when a timeout
146+
occurs. In that case, the "Abort" policy may be used to reduce resource consumption.
147+
148+
- Using RSA keys larger than 2048 bits can significantly slow down
149+
TLS computations. Consider using the "Abort" policy to reduce CPU usage.
150+
enum:
151+
- Abort
152+
- Continue
153+
type: string
112154
defaultCertificate:
113155
description: |-
114156
defaultCertificate is a reference to a secret containing the default

0 commit comments

Comments
 (0)