Add troubleshooting headless TCP service disconnects. #835
Conversation
|
|
||
| ## Headless TCP Services Losing Connection from Istiofied Containers | ||
|
|
||
| Envoy is reset every 15 minutes by the `istio-ca` deployment, as a part |
There was a problem hiding this comment.
If istio-ca is deployed, Envoy is restarted every 15 minutes to refresh the certificates, causing the disconnection of TCP streams or long-running connections.
There was a problem hiding this comment.
@andraxylia Do you want me to make these changes?
There was a problem hiding this comment.
Yes, please rephrase, sorry if that was not clear. Envoy is not restarted by the istio-ca, but by the pilot agent.
|
|
||
| ## Headless TCP Services Losing Connection from Istiofied Containers | ||
|
|
||
| Envoy is reset every 15 minutes by the `istio-ca` deployment, as a part |
|
|
||
| Envoy is reset every 15 minutes by the `istio-ca` deployment, as a part | ||
| of this process it will restart Envoy sidecars causing them to | ||
| disconnect TCP streams. In order to stop this from happening, you will |
There was a problem hiding this comment.
I would insert something like:
"While your TCP services should be resilient to rare connection close events (as your pods may move for a number of reasons instance), if you really need to keep long running connections, and until we release the version of Istio that doesn't require envoy restart for certificate reload, you will have to disable mTLS [...]"
(though that's kind of a loooong sentence)
There was a problem hiding this comment.
@ldemailly 15 minutes isn't a long TCP connection. DB connections often stay open for hours by default before being recycled. Will add something about connection resilience as well.
|
Hey, I made the requested changes, had to open a new PR because the old repository was deleted: |
|
closing -> #870 |
3 participants
This PR adds documentation on how to prevent Istio from disconnecting connections to headless TCP services every 15 minutes or so.
See conversation here for reference:
istio/istio#506