Fix open connections when agent waits for CA approval #7686
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This closes the agent connection when the certificate sign requests waits for CA approval. refs #7680
mcktr
added
bug
|
Thanks a lot 👍 @lippserd @Al2Klimov This may have an influence on the JsonRCP problem, e.g. when you have thousands of agents which request signed certificates, and they re-connect all the time thus resulting in many open connections. @Al2Klimov please test in this specific regard, if you can better reproduce the crash. |
dnsmichi
approved these changes
Dec 9, 2019
yhabteab
added a commit
that referenced
this pull request
Jan 30, 2025
This was mistakenly introduced with PR #7686 due to too many open connections (#7680). This was wrong in the sense that closing the connection is simply out of place here and should have been handled differently. After we revised the RPC connection disconnect procedure with `v2.14.4`, it becomes clear why it is wrong, because the connection is closed abruptly before the corressponding response (`result`) has even been written. Now if you remove the disconnect here, shouldn't the issue #7680 occur again, you ask? The answer is no, because we now also have a maximum timeout of `10s` for anonymous connections, after which they are automatically closed. Thanks to the introduction of this timeout by @jbrost in #8479, this `Disconnect()` call has become superfluous.
yhabteab
added a commit
that referenced
this pull request
Jan 30, 2025
This was mistakenly introduced with PR #7686 due to too many open connections (#7680). This was wrong in the sense that closing the connection is simply out of place here and should have been handled differently. After we revised the RPC connection disconnect procedure with `v2.14.4`, it becomes clear why it is wrong, because the connection is closed abruptly before the corresponding response (`result`) has even been written. Now if you remove the disconnect here, shouldn't the issue #7680 occur again, you ask? The answer is no, because we now also have a maximum timeout of `10s` for anonymous connections, after which they are automatically closed. Thanks to the introduction of this timeout by @julianbrost in #8479, this `Disconnect()` call has become superfluous.
yhabteab
added a commit
that referenced
this pull request
Feb 4, 2025
This was mistakenly introduced with PR #7686 due to too many open connections (#7680). This was wrong in the sense that closing the connection is simply out of place here and should have been handled differently. After we revised the RPC connection disconnect procedure with `v2.14.4`, it becomes clear why it is wrong, because the connection is closed abruptly before the corresponding response (`result`) has even been written. Now if you remove the disconnect here, shouldn't the issue #7680 occur again, you ask? The answer is no, because we now also have a maximum timeout of `10s` for anonymous connections, after which they are automatically closed. Thanks to the introduction of this timeout by @julianbrost in #8479, this `Disconnect()` call has become superfluous.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This closes the agent connection when the certificate sign requests
waits for CA approval.
For testing this use the setup from #7680 (comment).
Monitor the open files with:
The amount should be constant.
Before:
After:
fixes #7680