New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Etcd watch stream starvation under high read response load when sharing same connection and TLS is enabled #15402
Comments
Signed-off-by: Marek Siarkowicz <[email protected]>
Signed-off-by: Marek Siarkowicz <[email protected]>
Signed-off-by: Marek Siarkowicz <[email protected]>
Signed-off-by: Marek Siarkowicz <[email protected]>
Signed-off-by: Marek Siarkowicz <[email protected]>
Signed-off-by: Marek Siarkowicz <[email protected]>
Signed-off-by: Marek Siarkowicz <[email protected]>
Problem definitionThere are two issues we want to address related to etcd endpoint setup:
Watch starvationCaused by running grpc server under http server which is affected by golang/go#58804. For the watch starvation we can:
Running grpc under http serverServing grpc server under http it is an experimental API with different performance and features. To avoid running grpc under http server we can:
Requirements
ProposalImplement changes and execute backports in the order below:
Motivation
BackgroundList of etcd http paths:
EDIT 1: based on @ptabor feedback, I removed |
HI @serathius is it possible to maintain a round-robin scheduler writer? I think it is good for that metrics, which the latency is more predicatable as there is max concurrent streams. The scheduler writer runs without lock. Maybe it could be easier~. |
Prefer to avoid backporting untested code especially if it would be written by me :P. I would wait for grpc experts to implement it and test it. |
|
LGTM. I would consider also:
|
|
Discussed @fuweid idea with @mborsz. Implementing it based on Random scheduler should be much simpler than fixing golang/go#58804 which will need to modify priority scheduler. I will try to implement round-robin scheduling. Thanks for suggestion @fuweid |
|
|
@serathius thanks!!! |
|
Quick look into implementation of random write scheduler shows that it's isn't so random :P. It prioritizes writing control frames. This also done by priority scheduler. Unfortunately method to check if frame is a control frame is not public https://go.googlesource.com/net/+/master/http2/writesched_random.go#48 (thanks Go). Meaning that custom implementation of scheduler will already be subpar. I can implement scheduler that treats all frames the same, however I'm not expert in http2, so it's hard to guess what it could break. EDIT: Or we can guess what it breaks. https://go.googlesource.com/net/+/04296fa82e83b85317bd93ad50dd00460d6d7940%5E%21/http2/writesched_random.go. Nice to see familiar people. @aojea would love to get your thoughts on this issue. |
|
IIUIC the problem here is with DATA frames , those are the ones that can cause starvation. Control frames are not carrying much data, they are used for signaling, and per RFC they MUST not be considered for flow-control https://www.rfc-editor.org/rfc/rfc7540
One interesting thing is that if you were using the http2 implementation from golang/x/net instead of the one in the standaard library, is that you. probably were using the Random scheduler until last year https://go-review.googlesource.com/c/net/+/382015 Based on this comment from Brad Fitzpatrick https://go-review.googlesource.com/c/net/+/382015/comments/16b761d4_4c27bf6f and that the problem here are DATA frames, I'm +1 on the Random Scheduler if it demonstrates that it solves the problem |
The most enqueued control frame is the connection-level windows update. It's filed by each request body read. But the x/net/http2 only files one connection-level windows update if the pending size >= 4k. Since the ETCD server is using x/net/http2, the number of control frame won't be too much.
Yeah. It is painful. If the In the #15446 , it is going to use grpc-go underlying http2. It seems that the grpc-go has some enhancements for the window update, like BDP grpc/grpc-go#2400. Just my two cents is that if the FIFO scheduler (just like grpc-go http2) is better than random (we need test result), it's worth to make |
|
I'll defer to others with more context about whether splitting http and grpc listeners is necessary, and will just comment on the proposed mechanism for splitting Making
Do all existing clients currently expect to speak grpc over http/2? Will there be any client-visible change or impact of splitting grpc and http? Will existing clients need to change what they specify in their config to target both the http and grpc endpoints? |
Whole V3 etcd API is available on grpc. From pure API stand there is no impact.
As mentioned above
Depends on client:
|
Signed-off-by: Marek Siarkowicz <[email protected]>
Signed-off-by: Marek Siarkowicz <[email protected]>
|
Working with @aojea on replacing Cmux, will propose update to the proposal soon. Our main concern is backporting new untested code. |
|
Updated the proposal in #15402 (comment) tldr; We will still backport running http and grpc on separate port, but instead making it default, we will use @aojea customized connection multiplexer for etcd thus avoiding a breaking change. |
ClarificationIf I understand it correctly, the following proposal Should be updated as below to avoid confusion & misunderstanding, It seems that the link frame scheduler round-robin algorithm isn't accessible outside google? CommentPlease clearly state the impact on K8s. My understanding is that there is no impact if K8s uses I am not sure whether K8s uses other http endpoints. cc @liggitt
Why do you update stable release 3.4 & 3.5 again in future? No matter which way we follow, If there is no any issue, let's keep it as it's. |
No, the proposal above is consistent with the plan.
Sorry, assumed that it is public as bot linked it to the issue.
With current proposal, there is no impact.
Random scheduler is not enough to fully address the issue, so clusters that will not use |
No plan for rollback. As discussed on #15510 (comment) there is no 100% guarantee that multiplexing grpc and http2 will always work for all clients. Whole idea is incorrect and for total safely we should recommend users to separate grpc and http.
There is no breaking change for K8s, for etcd users we will use #15479 to confirm that there is no breaking change. Would be good to also cover jetcd, however not sure if that will be easy to automate. |
+1 to this, since grpc uses http2 as the transport,and t also builds some custom transport behaviors on top of it, I think that the best solution is to completely separate them. cmux or the PR I sent replacing cmux are not completely safe and can't guarantee future compatibility... and in the best of the cases will be always suboptimal since add another layer of buffering |

Formed in 2009, the Archive Team (not to be confused with the archive.org Archive-It Team) is a rogue archivist collective dedicated to saving copies of rapidly dying or deleted websites for the sake of history and digital heritage. The group is 100% composed of volunteers and interested parties, and has expanded into a large amount of related projects for saving online and digital history.

What happened?
When etcd client is generating high read response load, it can result in watch response stream in the same connection being starved. For example a client with an open watch and running 10 concurrent Range requests each returning around 10MB. The watch might get starved and not get any response for tens of seconds.
Problem does not occur when TLS is not enabled nor when watch is created on separate client/connection.
This affects also K8s (any version) as Kubernetes has one client per resource. Problem will trigger when single K8s resource has a lot of data and there are 10+ concurrent LIST requests for the same resource send to apiserver. For example 10k pods. This can cause serious correctness issues in K8s, like controllers not doing any job as they depend on watch to get updates. For example scheduler not scheduling any pods.
We tested and confirmed that all v3.4+ versions are affected.
Issue affects any watch response type:
What did you expect to happen?
Watch stream should never get blocked no matter the load.
How can we reproduce it (as minimally and precisely as possible)?
Repro for progress notify:
Start etcd with TLS and progress notify, for example:
insert a lot of data into etcd, for example run command below couple of times.
Run program below
Instead of getting logs like:
We get logs like:
And next notify response never comes.
Alternatively run ready e2e test:
5c26ded
Anything else we need to know?
With help of @mborsz I managed to find the root cause:
I have a fix in work in release-3.4...serathius:etcd:fix-watch-starving
Will send PR when ready
Etcd version (please run commands below)
All etcd versions
Etcd configuration (command line flags or environment variables)
Any config with TLS enabled
Etcd debug information (please run commands below, feel free to obfuscate the IP address or FQDN in the output)
N/A
Relevant log output
No response
The text was updated successfully, but these errors were encountered: