Skip to content

[WIP] OCPBUGS-61858: Implement HTTPKeepAliveTimeout tuning option #1297

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

[WIP] OCPBUGS-61858: Implement HTTPKeepAliveTimeout tuning option #1297

wants to merge 3 commits into from

Conversation

@alebedev87
Copy link
Contributor

Implements HTTPKeepAliveTimeout tuning option: openshift/api#2547.

@alebedev87
[WIP] OCPBUGS-61858: Bump openshift/api to latest and k8s/* to 0.34.1
c76f77e 
This commit updates `openshift/api` to the latest version to include the new
IngressController tuning option: `HTTPKeepAliveTimeout`.

Because of the `openshift/api` update, all `k8s/*` modules have been bumped
to `v0.34.1` for compatibility.

Commands used for the update:
```
go get openshift/api@master
go get k8s.io/[email protected]
go get k8s.io/[email protected]
go get k8s.io/[email protected]
go get k8s.io/[email protected]
make crd
go mod tidy
go mod vendor
```
@alebedev87
[WIP] OCPBUGS-61858: Vendor for bump openshift/api to latest and k8s/…
0bb45fc 
…* to 0.34.1
@openshift-ci-robot openshift-ci-robot added jira/severity-critical Referenced Jira bug's severity is critical for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Oct 24, 2025
@openshift-ci-robot
Copy link
Contributor

@alebedev87: This pull request references Jira Issue OCPBUGS-61858, which is invalid:

  • expected the bug to target the "4.21.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Implements HTTPKeepAliveTimeout tuning option: openshift/api#2547.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@alebedev87 alebedev87 changed the title OCPBUGS-61858: Implement HTTPKeepAliveTimeout tuning option [WIP] OCPBUGS-61858: Implement HTTPKeepAliveTimeout tuning option Oct 24, 2025
@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 24, 2025
@openshift-ci openshift-ci bot requested review from candita and miheer October 24, 2025 10:06
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Oct 24, 2025

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign thealisyed for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@alebedev87 alebedev87 force-pushed the OCPBUGS-61858-http-keep-alive-timeout branch from dacdff4 to e1b5aad Compare October 24, 2025 10:44
@alebedev87
Copy link
Contributor Author

Manual test:

$ oc -n openshift-ingress-operator get ingresscontroller default -o yaml | yq .spec.tuningOptions
httpKeepAliveTimeout: 30s
reloadInterval: 0s

$ oc -n openshift-ingress get pods
NAME                             READY   STATUS    RESTARTS   AGE
router-default-86c6b4584-m5zdv   1/1     Running   0          2m26s
router-default-86c6b4584-wxxhq   1/1     Running   0          2m26s

$ oc -n openshift-ingress get pods router-default-86c6b4584-m5zdv -o yaml | grep -A1 KEEPALIVE
    - name: ROUTER_SLOWLORIS_HTTP_KEEPALIVE
      value: 30s

$ oc -n openshift-ingress get pods router-default-86c6b4584-wxxhq -o yaml | grep -A1 KEEPALIVE
    - name: ROUTER_SLOWLORIS_HTTP_KEEPALIVE
      value: 30s

$ show-config router-default-86c6b4584-m5zdv | grep http-keep-alive
  timeout http-keep-alive 30s
  #option http-keep-alive

$ show-config router-default-86c6b4584-wxxhq | grep http-keep-alive
  timeout http-keep-alive 30s
  #option http-keep-alive

@alebedev87
Copy link
Contributor Author

/retest

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Oct 24, 2025

@alebedev87: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-pre-release-ossm e1b5aad link false /test e2e-aws-pre-release-ossm
ci/prow/hypershift-e2e-aks e1b5aad link true /test hypershift-e2e-aks

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@ShudiLi
Copy link
Member

ShudiLi commented Oct 29, 2025 •
edited
Loading

Tested it with 4.21.0-0-2025-10-29-070835-test-ci-ln-g86vs5k-latest

1.
% oc get clusterversion
NAME      VERSION                                                AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.21.0-0-2025-10-29-070835-test-ci-ln-g86vs5k-latest   True        False         87m     Cluster version is 4.21.0-0-2025-10-29-070835-test-ci-ln-g86vs5k-latest

2. Configure the httpKeepAliveTimeout with different values, including the invalid 50d
% oc -n openshift-ingress-operator get ingresscontroller default -oyaml | yq ".spec.tuningOptions"
httpKeepAliveTimeout: 50ms
reloadInterval: 0s
% oc -n openshift-ingress-operator get ingresscontroller default -oyaml | yq ".spec.tuningOptions"
httpKeepAliveTimeout: 50m
reloadInterval: 0s
% oc -n openshift-ingress-operator get ingresscontroller default -oyaml | yq ".spec.tuningOptions"
httpKeepAliveTimeout: 50h
reloadInterval: 0s

# ingresscontrollers.operator.openshift.io "default" was not valid:
# * spec.tuningOptions.httpKeepAliveTimeout: Invalid value: "50d": spec.tuningOptions.httpKeepAliveTimeout in body should match '^(0|([0-9]+(\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+)$'
#


3.  configure it with 50s
% oc -n openshift-ingress-operator get ingresscontroller default -oyaml | yq ".spec.tuningOptions"
httpKeepAliveTimeout: 50s
reloadInterval: 0s

% oc -n openshift-ingress rsh router-default-94887c8b8-5kk8w
sh-5.1$ env | grep -i alive
ROUTER_SLOWLORIS_HTTP_KEEPALIVE=50s
sh-5.1$
sh-5.1$

4. create pods, service and route for the function test
% oc -n test get route
NAME          HOST/PORT                                                                     PATH   SERVICES      PORT          TERMINATION   WILDCARD
unsec-apach   unsec-apach-test.apps.ci-ln-g86vs5k-72292.origin-ci-int-gce.dev.rhcloud.com          unsec-apach   unsec-apach                 None

5. Send traffic and check after about 50s the fin is received on the client side
sh-4.4# tcpdump -i any port 80 -s 0 -n -v
dropped privs to tcpdump
tcpdump: listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
09:13:45.977861 IP (tos 0x0, ttl 64, id 23269, offset 0, flags [DF], proto TCP (6), length 60)
    10.128.2.18.55864 > 136.113.209.231.http: Flags [S], cksum 0x6719 (incorrect -> 0xee2b), seq 166188194, win 64680, options [mss 1320,sackOK,TS val 385033927 ecr 0,nop,wscale 7], length 0
09:13:45.981353 IP (tos 0x0, ttl 62, id 0, offset 0, flags [DF], proto TCP (6), length 60)
    136.113.209.231.http > 10.128.2.18.55864: Flags [S.], cksum 0xa864 (correct), seq 3504820758, ack 166188195, win 65400, options [mss 1320,sackOK,TS val 4180289213 ecr 385033927,nop,wscale 7], length 0
09:13:45.981407 IP (tos 0x0, ttl 64, id 23270, offset 0, flags [DF], proto TCP (6), length 52)
    10.128.2.18.55864 > 136.113.209.231.http: Flags [.], cksum 0x6711 (incorrect -> 0xd41f), ack 1, win 506, options [nop,nop,TS val 385033931 ecr 4180289213], length 0
09:13:45.981594 IP (tos 0x0, ttl 64, id 23271, offset 0, flags [DF], proto TCP (6), length 159)
    10.128.2.18.55864 > 136.113.209.231.http: Flags [P.], cksum 0x677c (incorrect -> 0x66fa), seq 1:108, ack 1, win 506, options [nop,nop,TS val 385033931 ecr 4180289213], length 107: HTTP, length: 107
	GET /a1.txt  HTTP/1.1
	Host:unsec-apach-test.apps.ci-ln-g86vs5k-72292.origin-ci-int-gce.dev.rhcloud.com
	
09:13:45.986643 IP (tos 0x0, ttl 62, id 54542, offset 0, flags [DF], proto TCP (6), length 477)
    136.113.209.231.http > 10.128.2.18.55864: Flags [P.], cksum 0xc2f2 (correct), seq 1:426, ack 108, win 511, options [nop,nop,TS val 4180289218 ecr 385033931], length 425: HTTP, length: 425
	HTTP/1.1 200 OK
	date: Wed, 29 Oct 2025 09:13:45 GMT
	server: Apache/2.4.37 (centos) OpenSSL/1.1.1k
	upgrade: h2c
	connection: Upgrade
	last-modified: Wed, 29 Oct 2025 09:05:38 GMT
	etag: "c-642486fa9ac83"
	accept-ranges: bytes
	content-length: 12
	content-type: text/plain; charset=UTF-8
	set-cookie: fe27bc5d3b8db7d9308afdc84b692496=aba716f055ad746da27df0e3d2408bfa; path=/; HttpOnly
	cache-control: private
	
	aaa111 text
09:13:45.986681 IP (tos 0x0, ttl 64, id 23272, offset 0, flags [DF], proto TCP (6), length 52)
    10.128.2.18.55864 > 136.113.209.231.http: Flags [.], cksum 0x6711 (incorrect -> 0xd204), ack 426, win 503, options [nop,nop,TS val 385033936 ecr 4180289218], length 0
09:14:35.989919 IP (tos 0x0, ttl 62, id 54543, offset 0, flags [DF], proto TCP (6), length 52)
    136.113.209.231.http > 10.128.2.18.55864: Flags [F.], cksum 0x0ea9 (correct), seq 426, ack 108, win 511, options [nop,nop,TS val 4180339220 ecr 385033936], length 0
09:14:36.030205 IP (tos 0x0, ttl 64, id 23273, offset 0, flags [DF], proto TCP (6), length 52)
    10.128.2.18.55864 > 136.113.209.231.http: Flags [.], cksum 0x6711 (incorrect -> 0x4b34), ack 427, win 503, options [nop,nop,TS val 385083980 ecr 4180339220], length 0
09:14:45.959906 IP (tos 0x0, ttl 64, id 23274, offset 0, flags [DF], proto TCP (6), length 158)
    10.128.2.18.55864 > 136.113.209.231.http: Flags [P.], cksum 0x677b (incorrect -> 0x1a03), seq 108:214, ack 427, win 503, options [nop,nop,TS val 385093909 ecr 4180339220], length 106: HTTP, length: 106
	GET /a2.txt HTTP/1.1
	Host:unsec-apach-test.apps.ci-ln-g86vs5k-72292.origin-ci-int-gce.dev.rhcloud.com
	
09:14:45.961091 IP (tos 0x0, ttl 62, id 0, offset 0, flags [DF], proto TCP (6), length 40)
    136.113.209.231.http > 10.128.2.18.55864: Flags [R], cksum 0x49c4 (correct), seq 3504821185, win 0, length 0

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@candita candita Awaiting requested review from candita

@miheer miheer Awaiting requested review from miheer

Assignees

No one assigned

Labels

do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. jira/severity-critical Referenced Jira bug's severity is critical for the branch this PR is targeting. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@alebedev87 @openshift-ci-robot @ShudiLi