OCPBUGS-38078: Validate HAProxy health check interval time value #618
Conversation
openshift-ci-robot
added
jira/severity-moderate
|
@grzpiotrowski: This pull request references Jira Issue OCPBUGS-38078, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request. The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@grzpiotrowski: This pull request references Jira Issue OCPBUGS-38078, which is valid. 3 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@grzpiotrowski unless someone has advised you otherwise, I will request that you do not rename the function or constant. It will make this easier to review and backport, by simplifying the number of changes. |
grzpiotrowski
force-pushed
the
OCPBUGS-38078-haproxy-healthcheck-interval
branch
from
0e507e4
to
0ecfb1b
Compare
Yes, I didn't consider the ease of backporting in this case. |
|
I was just wondering, should we keep the log messages unchanged or adjust them to say Example of a log for clipping the health check interval now: template_helper.go:356] "msg"="route annotation timeout exceeds maximum allowable by HAProxy, clipping to 2147483647ms" "input"="50000d" "logger"="template" |
Mark bug as verified |
openshift-ci
bot
added
the
qe-approved
|
/retest |
|
/assign |
|
Unrelated failure in e2e-agnostic.
/test e2e-agnostic |
|
As far as gathering a list of other places we may need to clip values, I found some that are not annotations: router/images/router/haproxy/conf/haproxy-config.template Lines 158 to 167 in 0ecfb1b However, in https://github.com/openshift/cluster-ingress-operator/blob/8252ac492c04d161fbcf60ef82af2989c99f4a9d/pkg/operator/controller/ingress/deployment.go#L610-L634 we do take care of clipping them. |
|
@grzpiotrowski this looks good, but we will need some kind of test with this to make sure there are no regressions over time, and validate that it works as is. Maybe something like adding a few test cases to the tests in |
* pkg/router/router_test.go (mustCreate): Rename... (mustCreateRoute): ... to this.
* pkg/router/router_test.go (harness): Add a client field. (TestMain): Initialize the harness client field with the Kubernetes client set. (TestConfigTemplate): Add test cases where the endpointslice associated with the route specifies appProtocol with the recognized value "h2c" and unrecognized values "unknown-value" and "kubernetes.io/h2c". Verify that the recognized value causes "proto h2" to be added to the backend server line and that the unrecognized values do not. Modify the test logic to apply an optional mustCreateEndpointSlice from the test expectations. (mustCreateRoute): Add targetServiceName field. ((mustCreateRoute).Apply): Initialize the route's spec.to.name field to the targetServiceName value from the mustCreateRoute parameters if it is specified. This new parameter isn't strictly required for the new test cases, but it makes them more explicit and easier to read. (mustCreateEndpointSlice): New type, used in the new test cases. ((mustCreateEndpointSlice).Apply): Create an endpointslice using the Kubernetes API client set from the harness and the specified endpointslice name, service name, and port appProtocol value from the mustCreateEndpointSlice parameters. (mustCreateWithConfig): Add mustCreateEndpointSlice so that the new test cases can use it. (matchConfig): Add logic for parsing the "server" attribute, which the new test cases use.
This commit fixes OCPBUGS-42972. https://issues.redhat.com/browse/OCPBUGS-42972 * images/router/haproxy/conf/haproxy-config.template: * pkg/router/template/configmanager/haproxy/backend.go ((Backend).UpdateServerInfo): * pkg/router/template/configmanager/haproxy/manager.go ((haproxyConfigManager).ReplaceRouteEndpoints): Recognize both "h2c" and "kubernetes.io/h2c" as valid values for appProtocol. * pkg/router/router_test.go (TestConfigTemplate): Update the expectations for the "route with appProtocol: kubernetes.io/h2c" test case.
Use clipHAProxyTimeoutValue on router.openshift.io/haproxy.health.check.interval annotation to ensure it is within the range that HAProxy can parse. This commit fixes OCPBUGS-38078. https://issues.redhat.com/browse/OCPBUGS-38078 * images/router/haproxy/conf/haproxy-config.template: Use clipHAProxyTimeoutValue on `router.openshift.io/haproxy.health.check.interval` annotation.
* pkg/router/router_test.go: (TestConfigTemplate): Add test cases for route health check interval annotation. Verify that the correct value is added to the backend server line and that the values exceeding the maximum haproxy time value get clipped to the max limit. Verify that invalid annotation values result in the default health check interval value applied. (MustCreateRoute): Add targetServiceWeight field ((MustCreateRoute).Apply): Initialize the route's spec.to.weight to the targetServiceWeight value from the mustCreateRoute parameters if it is specified. This parameter allows to set a non-zero weight for the service, making the endpoint Active as a result. (MustCreateEndpointSlice): Add addresses field ((MustCreateEndpointSlice).Apply): Initialize the endpoint's Addresses field to the addresses array from the mustCreateEndpointSlice parameters if specified. This enables having at least two endpoints for the route in the test case and satisfy the conditions needed to configure the check inter in the backend server line.
grzpiotrowski
force-pushed
the
OCPBUGS-38078-haproxy-healthcheck-interval
branch
from
0ecfb1b
to
e9081e6
Compare
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
I finally added the health check interval test cases in the |
|
@grzpiotrowski: The following test failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
The maximum valid time representing value in HAProxy is 2147483647ms (max positive value for a 32-bit signed integer).
Setting time value to one exceeding the maximum handled by HAProxy for
router.openshift.io/haproxy.health.check.intervalbreaks the router-default pods.Prior to this PR
clipHAProxyTimeoutValuewas used to validate the timeout values set in annotations likehaproxy.router.openshift.io/timeoutorhaproxy.router.openshift.io/timeout-tunnel.By reusing the
clipHAProxyTimeoutValuefunction, this PR adds the same validation for the value set inrouter.openshift.io/haproxy.health.check.intervalannotation to ensure it is within the range that HAProxy can parse.