Istio ingress and AWS ALB idle timeout

Networking
1

Hello,

We run istio 1.0.6 with Ingress configured as NodePort, we also have ALB configured for those ports. After about 24 hours or --conntrack-tcp-timeout-established timeout configured in kube-proxy settings we’re getting 502 errors on the ALB. It happens due to non graceful tcp connection termination by conntrack module that kube-proxy configures. The only option I found on how to fix it is to patch istio pilot to configure idle_timeout of the ingress. Unfortunately istio does not expose it.

Does anyone use istio with ALB? If yes, how do you deal with those timeouts? Is there a configuration I’m missing on how to configure it?

2

There is no configuration as of now. but its relatively easy to add in the mesh config

3

I’d be happy to contribute. Something like google.protobuf.Duration ingress_idle_timeout = 37; in MeshConfig of config.proto?

4

http_idle_timeout… it would apply globally across all connections (edge and internal)

5

Would http_idle_timeout apply to http2 connection? If so, i think it’s not user expected.

6

@rshriram I submitted the following PR: https://github.com/istio/api/pull/879

Please note there is a similar one already: https://github.com/istio/api/pull/799