Skip to content

Commit 61a5799

Browse files
alebedev87alebedev87
committed
OCPBUGS-61858: Add HTTPKeepAliveTimeout to IngressController API
This commit introduces `HTTPKeepAliveTimeout` tuning option to the IngressController API, allowing customers to configure `timeout http-keep-alive`. In OCP versions prior to 4.16, this timeout was not respected (see haproxy/haproxy#2334). This addition brings the ability to adjust the behavior to match pre-4.16 configurations.
1 parent 8691c30 commit 61a5799

File tree

7 files changed

+168
-0
lines changed

7 files changed

+168
-0
lines changed

‎openapi/generated_openapi/zz_generated.openapi.go‎

Lines changed: 6 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎operator/v1/tests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -563,6 +563,91 @@ tests:
563563
tuningOptions:
564564
connectTimeout: "4 s"
565565
expectedError: "IngressController.operator.openshift.io \"default\" is invalid: spec.tuningOptions.connectTimeout: Invalid value: \"4 s\": spec.tuningOptions.connectTimeout in body should match '^(0|([0-9]+(\\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$'"
566+
- name: Should be able to create an IngressController with valid nominal httpKeepAlive timeout
567+
initial: |
568+
apiVersion: operator.openshift.io/v1
569+
kind: IngressController
570+
metadata:
571+
name: default
572+
namespace: openshift-ingress-operator
573+
spec:
574+
tuningOptions:
575+
httpKeepAliveTimeout: 10s
576+
expected: |
577+
apiVersion: operator.openshift.io/v1
578+
kind: IngressController
579+
metadata:
580+
name: default
581+
namespace: openshift-ingress-operator
582+
spec:
583+
httpEmptyRequestsPolicy: Respond
584+
idleConnectionTerminationPolicy: Immediate
585+
tuningOptions:
586+
httpKeepAliveTimeout: 10s
587+
- name: Should be able to create an IngressController with valid composite httpKeepAlive timeout
588+
initial: |
589+
apiVersion: operator.openshift.io/v1
590+
kind: IngressController
591+
metadata:
592+
name: default
593+
namespace: openshift-ingress-operator
594+
spec:
595+
tuningOptions:
596+
httpKeepAliveTimeout: 100ms300μs
597+
expected: |
598+
apiVersion: operator.openshift.io/v1
599+
kind: IngressController
600+
metadata:
601+
name: default
602+
namespace: openshift-ingress-operator
603+
spec:
604+
httpEmptyRequestsPolicy: Respond
605+
idleConnectionTerminationPolicy: Immediate
606+
tuningOptions:
607+
httpKeepAliveTimeout: 100ms300μs
608+
- name: Should be able to create an IngressController with valid fraction httpKeepAlive timeout
609+
initial: |
610+
apiVersion: operator.openshift.io/v1
611+
kind: IngressController
612+
metadata:
613+
name: default
614+
namespace: openshift-ingress-operator
615+
spec:
616+
tuningOptions:
617+
httpKeepAliveTimeout: 1.5m
618+
expected: |
619+
apiVersion: operator.openshift.io/v1
620+
kind: IngressController
621+
metadata:
622+
name: default
623+
namespace: openshift-ingress-operator
624+
spec:
625+
httpEmptyRequestsPolicy: Respond
626+
idleConnectionTerminationPolicy: Immediate
627+
tuningOptions:
628+
httpKeepAliveTimeout: 1.5m
629+
- name: Should not be able to create an IngressController with invalid unit httpKeepAlive timeout
630+
initial: |
631+
apiVersion: operator.openshift.io/v1
632+
kind: IngressController
633+
metadata:
634+
name: default
635+
namespace: openshift-ingress-operator
636+
spec:
637+
tuningOptions:
638+
httpKeepAliveTimeout: 3d
639+
expectedError: "IngressController.operator.openshift.io \"default\" is invalid: spec.tuningOptions.httpKeepAliveTimeout: Invalid value: \"3d\": spec.tuningOptions.httpKeepAliveTimeout in body should match '^(0|([0-9]+(\\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$'"
640+
- name: Should not be able to create an IngressController with invalid space httpKeepAlive timeout
641+
initial: |
642+
apiVersion: operator.openshift.io/v1
643+
kind: IngressController
644+
metadata:
645+
name: default
646+
namespace: openshift-ingress-operator
647+
spec:
648+
tuningOptions:
649+
httpKeepAliveTimeout: "4 s"
650+
expectedError: "IngressController.operator.openshift.io \"default\" is invalid: spec.tuningOptions.httpKeepAliveTimeout: Invalid value: \"4 s\": spec.tuningOptions.httpKeepAliveTimeout in body should match '^(0|([0-9]+(\\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$'"
566651
- name: Should be able to create an IngressController with valid domain
567652
initial: |
568653
apiVersion: operator.openshift.io/v1

‎operator/v1/types_ingress.go‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1884,6 +1884,31 @@ type IngressControllerTuningOptions struct {
18841884
// +optional
18851885
ConnectTimeout *metav1.Duration `json:"connectTimeout,omitempty"`
18861886

1887+
// httpKeepAliveTimeout defines the maximum allowed time to wait for
1888+
// a new HTTP request to appear.
1889+
//
1890+
// This field expects an unsigned duration string of decimal numbers, each with optional
1891+
// fraction and a unit suffix, e.g. "300ms", "1.5h" or "2h45m".
1892+
// Valid time units are "ns", "us" (or "µs" U+00B5 or "μs" U+03BC), "ms", "s", "m", "h".
1893+
//
1894+
// When omitted, this means the user has no opinion and the platform is left
1895+
// to choose a reasonable default. This default is subject to change over time.
1896+
// The current default is 300s.
1897+
//
1898+
// Low values (tens of milliseconds or less) can cause clients to close and reopen connections
1899+
// for each request, leading to excessive TCP or SSL handshakes.
1900+
// For HTTP/2, special care should be taken with low values.
1901+
// A few seconds is a reasonable starting point to avoid holding idle connections open
1902+
// while still allowing subsequent requests to reuse the connection.
1903+
//
1904+
// High values (more than a minute) can cause idle connections to linger,
1905+
// increasing exposure to long-lived but inactive connection attacks.
1906+
//
1907+
// +kubebuilder:validation:Pattern=^(0|([0-9]+(\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$
1908+
// +kubebuilder:validation:Type:=string
1909+
// +optional
1910+
HTTPKeepAliveTimeout *metav1.Duration `json:"httpKeepAliveTimeout,omitempty"`
1911+
18871912
// tlsInspectDelay defines how long the router can hold data to find a
18881913
// matching route.
18891914
//

‎operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers.crd.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2250,6 +2250,29 @@ spec:
22502250
2147483647ms (24.85 days). Both are subject to change over time.
22512251
pattern: ^(0|([0-9]+(\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$
22522252
type: string
2253+
httpKeepAliveTimeout:
2254+
description: |-
2255+
httpKeepAliveTimeout defines the maximum allowed time to wait for
2256+
a new HTTP request to appear.
2257+
2258+
This field expects an unsigned duration string of decimal numbers, each with optional
2259+
fraction and a unit suffix, e.g. "300ms", "1.5h" or "2h45m".
2260+
Valid time units are "ns", "us" (or "µs" U+00B5 or "μs" U+03BC), "ms", "s", "m", "h".
2261+
2262+
When omitted, this means the user has no opinion and the platform is left
2263+
to choose a reasonable default. This default is subject to change over time.
2264+
The current default is 300s.
2265+
2266+
Low values (tens of milliseconds or less) can cause clients to close and reopen connections
2267+
for each request, leading to excessive TCP or SSL handshakes.
2268+
For HTTP/2, special care should be taken with low values.
2269+
A few seconds is a reasonable starting point to avoid holding idle connections open
2270+
while still allowing subsequent requests to reuse the connection.
2271+
2272+
High values (more than a minute) can cause idle connections to linger,
2273+
increasing exposure to long-lived but inactive connection attacks.
2274+
pattern: ^(0|([0-9]+(\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$
2275+
type: string
22532276
maxConnections:
22542277
description: |-
22552278
maxConnections defines the maximum number of simultaneous

‎operator/v1/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎operator/v1/zz_generated.featuregated-crd-manifests/ingresscontrollers.operator.openshift.io/AAA_ungated.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2233,6 +2233,29 @@ spec:
22332233
2147483647ms (24.85 days). Both are subject to change over time.
22342234
pattern: ^(0|([0-9]+(\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$
22352235
type: string
2236+
httpKeepAliveTimeout:
2237+
description: |-
2238+
httpKeepAliveTimeout defines the maximum allowed time to wait for
2239+
a new HTTP request to appear.
2240+
2241+
This field expects an unsigned duration string of decimal numbers, each with optional
2242+
fraction and a unit suffix, e.g. "300ms", "1.5h" or "2h45m".
2243+
Valid time units are "ns", "us" (or "µs" U+00B5 or "μs" U+03BC), "ms", "s", "m", "h".
2244+
2245+
When omitted, this means the user has no opinion and the platform is left
2246+
to choose a reasonable default. This default is subject to change over time.
2247+
The current default is 300s.
2248+
2249+
Low values (tens of milliseconds or less) can cause clients to close and reopen connections
2250+
for each request, leading to excessive TCP or SSL handshakes.
2251+
For HTTP/2, special care should be taken with low values.
2252+
A few seconds is a reasonable starting point to avoid holding idle connections open
2253+
while still allowing subsequent requests to reuse the connection.
2254+
2255+
High values (more than a minute) can cause idle connections to linger,
2256+
increasing exposure to long-lived but inactive connection attacks.
2257+
pattern: ^(0|([0-9]+(\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$
2258+
type: string
22362259
maxConnections:
22372260
description: |-
22382261
maxConnections defines the maximum number of simultaneous

‎operator/v1/zz_generated.swagger_doc_generated.go‎

Lines changed: 1 addition & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)