Skip to content

[8.18](backport #5372) Restore connection-level limiter - #5376

Merged
michel-laterman merged 5 commits into
8.18from
mergify/bp/8.18/pr-5372
Sep 4, 2025
Merged

michel-laterman merged 5 commits into
8.18from
mergify/bp/8.18/pr-5372

Conversation

@mergify

@mergify mergify Bot commented Aug 29, 2025

Copy link
Copy Markdown
Contributor

What is the problem this PR solves?

Use of only the throttle middleware can result in OOM incidents under high load.

How does this PR solve the problem?

Restore connection level limiter to prevent OOM incidents. (removed in #4402)
This limiter is used in addition to the request-level throttle so that once
our in-flight requests reaches max_connections a 429 is returned, but if the
total connections the server uses is over max_connections*1.1 the server drops
the connection before the TLS handshake.

Design Checklist

  • I have ensured my design is stateless and will work when multiple fleet-server instances are behind a load balancer.
  • I have or intend to scale test my changes, ensuring it will work reliably with 100K+ agents connected.
  • I have included fail safe mechanisms to limit the load on fleet-server: rate limiting, circuit breakers, caching, load shedding, etc.

Checklist

  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in ./changelog/fragments using the changelog tool
    This is an automatic backport of pull request Restore connection-level limiter #5372 done by Mergify.

Restore connection level limiter to prevent OOM incidents. (removed in #4402)
This limiter is used in addition to the request-level throttle so that once
our in-flight requests reaches max_connections a 429 is returned, but if the
total connections the server uses is over max_connections*1.1 the server drops
the connection before the TLS handshake.

(cherry picked from commit 39199ef)

# Conflicts:
#	NOTICE-fips.txt
#	NOTICE.txt
#	go.mod
#	internal/pkg/api/server.go
@mergify mergify Bot added backport conflicts There is a conflict in the backported pull request labels Aug 29, 2025
@mergify
mergify Bot requested a review from a team as a code owner August 29, 2025 21:50
@mergify mergify Bot added backport conflicts There is a conflict in the backported pull request labels Aug 29, 2025
@mergify
mergify Bot requested review from pchila and ycombinator August 29, 2025 21:50
@mergify

mergify Bot commented Aug 29, 2025

Copy link
Copy Markdown
Contributor Author

Cherry-pick of 39199ef has failed:

On branch mergify/bp/8.18/pr-5372
Your branch is up to date with 'origin/8.18'.

You are currently cherry-picking commit 39199ef.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	new file:   changelog/fragments/1756409821-Restore-connection-limiter.yaml
	new file:   internal/pkg/limit/listener.go
	new file:   internal/pkg/limit/listener_test.go

Unmerged paths:
  (use "git add/rm <file>..." as appropriate to mark resolution)
	deleted by us:   NOTICE-fips.txt
	both modified:   NOTICE.txt
	both modified:   go.mod
	both modified:   internal/pkg/api/server.go

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

@mergify mergify Bot mentioned this pull request Aug 29, 2025
6 tasks done
@github-actions github-actions Bot added bug Something isn't working Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team labels Aug 29, 2025
@prodsecmachine

prodsecmachine commented Aug 29, 2025 •

Copy link
Copy Markdown

🎉 Snyk checks have passed. No issues have been found so far.

✅ security/snyk check is complete. No issues have been found. (View Details)

✅ license/snyk check is complete. No issues have been found. (View Details)

michel-laterman added 2 commits August 29, 2025 15:51
@michel-laterman
michel-laterman enabled auto-merge (squash) August 29, 2025 23:21
@mergify

mergify Bot commented Sep 1, 2025

Copy link
Copy Markdown
Contributor Author

This pull request has not been merged yet. Could you please review and merge it @michel-laterman? 🙏

@michel-laterman

Copy link
Copy Markdown
Contributor

buildkite test this

@elastic-sonarqube

Copy link
Copy Markdown

@michel-laterman
michel-laterman merged commit d4bb97a into 8.18 Sep 4, 2025
8 checks passed
@michel-laterman
michel-laterman deleted the mergify/bp/8.18/pr-5372 branch September 4, 2025 19:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport bug Something isn't working conflicts There is a conflict in the backported pull request Team:Elastic-Agent-Control-Plane Label for the Agent Control Plane team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants