Skip to content
This repository was archived by the owner on Apr 10, 2024. It is now read-only.

Commit 8137188

Browse files
authored
Use HTTP/1.1 to perform readiness check (#156)
This change re-enables the readiness check, using HTTP/1.1 instead of HTTP/2 to invoke it. The readiness checks are unauthenticated and are throttled when the feature gate UnauthenticatedHTTP2DOSMitigation is set to true, which is the default starting in Kubernetes 1.29 (see https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates). This was the cause of the "GOAWAY received" errors that have been observed on Kubernetes 1.29. This change also decouples starting of the servers from waiting until they become ready, so that if the readiness check fails due to some error that propagates out of the polling loop (e.g. IOException), the caller is free to catch it and continue waiting.
1 parent 9518531 commit 8137188

File tree

2 files changed

+6
-3
lines changed

2 files changed

+6
-3
lines changed

core/src/main/java/io/javaoperatorsdk/jenvtest/process/KubeAPIServerProcess.java

+1-3
Original file line numberDiff line numberDiff line change
@@ -89,9 +89,7 @@ public void waitUntilReady() {
8989
var readinessChecker = new ProcessReadinessChecker();
9090
var timeout = config.getStartupTimeout();
9191
var startTime = System.currentTimeMillis();
92-
// the 1.29.0 binary has issue with this. Will temporarily comment out and further investigate.
93-
// But with this now all the executions are failing
94-
// readinessChecker.waitUntilReady(apiServerPort, "readyz", KUBE_API_SERVER, true, timeout);
92+
readinessChecker.waitUntilReady(apiServerPort, "readyz", KUBE_API_SERVER, true, timeout);
9593
int newTimout = (int) (timeout - (System.currentTimeMillis() - startTime));
9694
readinessChecker.waitUntilDefaultNamespaceAvailable(apiServerPort, binaryManager, certManager,
9795
config, newTimout);

core/src/main/java/io/javaoperatorsdk/jenvtest/process/ProcessReadinessChecker.java

+5
Original file line numberDiff line numberDiff line change
@@ -177,8 +177,13 @@ public void checkServerTrusted(
177177
}
178178
},
179179
null);
180+
// Set protocol to HTTP/1.1 for unauthenticated invocations of "GET /readyz". Sending
181+
// unauthenticated requests using HTTP/2 is problematic on Kubernetes >=1.29, which enables
182+
// denial-of-service mitigation for authenticated HTTP/2 by default with the
183+
// UnauthenticatedHTTP2DOSMitigation feature gate.
180184
return HttpClient.newBuilder()
181185
.sslContext(sslContext)
186+
.version(HttpClient.Version.HTTP_1_1)
182187
.build();
183188
} catch (NoSuchAlgorithmException | KeyManagementException e) {
184189
throw new JenvtestException(e);

0 commit comments

Comments
 (0)