Container plugin's param-less /pulpcore_registry ProxyPass makes Apache ignore timeout=600 on /pulp/api/v3 (mod_proxy worker sharing)

Open Beginner friendly
  • Is something wrong?
#417 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
84/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
apache
Domain
devops

Research direction

Start with manifests/plugin/container.pp and compare its ProxyPass entries with pulpcore::apache's api_proxy_params. Render the Apache configuration or run the minimal reproduction to verify that /pulp/api/v3 honors the longer timeout instead of the global Timeout; done means the request completes after the configured delay rather than returning a 502 at 60 seconds.

Written by the indexing model from the issue text.

Description

Summary

pulpcore::plugin::container adds a /pulpcore_registry ProxyPass to $pulpcore::apache::api_base_url without params. That backend URL is a leading prefix of the /pulp/api/v3 (and /pypi) backend URLs, so mod_proxy shares that parameterless worker and drops the parameters given later. As a result, the timeout=600 from $pulpcore::apache::api_proxy_params (added in #160) has no effect on /pulp/api/v3, and API requests fall back to httpd's global Timeout 60.

Environment
  • foreman-installer 5.0.0 (Katello scenario), puppet-pulpcore 14.3.0, on EL9 with httpd 2.4.62
  • manifests/plugin/container.pp on master still has no params on this ProxyPass
Rendered config (relevant lines, in file order)
<Location "/pulpcore_registry">
  ProxyPass unix:///run/pulpcore-api.sock|http://pulpcore-api
</Location>
...
<Location "/pypi">
  ProxyPass unix:///run/pulpcore-api.sock|http://pulpcore-api/pypi timeout=600
</Location>
...
<Location "/pulp/api/v3">
  ProxyPass unix:///run/pulpcore-api.sock|http://pulpcore-api/pulp/api/v3 timeout=600
</Location>

The Apache mod_proxy docs, under "Worker Sharing", say:

Worker sharing happens if the worker URLs overlap, which occurs when the URL of some worker is a leading substring of the URL of another worker defined later in the configuration file. [...] the second worker isn't actually created. Instead the first worker is used. [...] Note that all configuration attributes given explicitly for the later worker will be ignored.

Symptom

Katello content-view publishes pause with a Pulp 502. Apache logs this about 60 s after the request started:

[proxy_http:error] (70007)The timeout specified has expired: AH01102: error reading status line from remote server pulpcore-api:80

In one case Pulp finished the request after 83 s, but Apache had already returned the 502 at 60 s.

Minimal reproduction (plain httpd, no Foreman)

The backend is a unix-socket HTTP server that sleeps ?s=N seconds before replying. The global Timeout is 3 and the API location sets timeout=10. The request is GET /pulp/api/v3/...?s=6.

Variant Config Result
A param-less /pulpcore_registry ProxyPass before /pulp/api/v3 ... timeout=10 502 at 3 s (AH01102)
C only /pulp/api/v3 ... timeout=10 200 after 6 s
D as A, but the registry ProxyPass also has timeout=10 200 after 6 s
B as A, plus a global ProxyTimeout 10 200 after 6 s
Suggested fix

Pass the API proxy params in manifests/plugin/container.pp, the same way pulpcore::apache already does:

'proxy_pass'      => [
  {
    'url'    => $pulpcore::apache::api_base_url,
    'params' => $pulpcore::apache::api_proxy_params,
  },
],

The /pulp/container/ ProxyPass in the same file could take $pulpcore::apache::content_proxy_params for consistency.

Workaround

In /etc/foreman-installer/custom-hiera.yaml:

apache::mod::proxy::proxy_timeout: 600

This sets a global ProxyTimeout that the shared worker inherits (variant B). It is the same key the Foreman Tuning Performance guide documents for proxy timeouts.

Dominant language
Ruby
Stars
2
Forks
35
Avg merge
13h 43m
Merged PRs (30d)
2

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from theforeman/puppet-pulpcore

All issues in theforeman/puppet-pulpcore

Similar issues

More Ruby issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.