pomerium / pomerium / 21688118919

44%

Build Type

push

github

Committed by web-flow

Commit Message

feat(grpc): ensure "coordination" between keepalives in http/2 protocols in internal pomerium grpc impls (#6078)

## Summary

For gRPC:
- Ensure on both clients and servers we have:
- `PermitWithoutStream : true` ensures http/2 pings are sent without any
active stream RPCs occurring.
- Ensure that the outbound TCP listener closes unreachable connections
after 20s using TCP_USER_TIMEOUT on the socket
- For consistency, this matches our http/2 ping timeouts across the
board
- Ensure that http/2 pings from envoy to our servers are not sent more
frequently than at a 5 minute interval - to prevent grpc server from
sending GOAWAY with error=ENHANCE_YOUR_CALM to envoy, abruptly closing
the envoy http2 stream, but resulting in outbound clients with a
"half-closed" stream receiving RST_STREAM errors.
- Fixes a potential race condition with expiring contexts resulting in
grpc.ClientConn getting shut on a fresh & valid connection, causing
`ErrClientConnectionClose` on all subsequent connections

## Related issues


[ENG-2657](https://linear.app/pomerium/issue/ENG-2657/core-infinite-redirect-loop-after-switching-databroker-backend)

[ENG-3437](https://linear.app/pomerium/issue/ENG-3437/clustered-databroker-follower-health-graceful-shutdown-error-from-sync)

[ENG-3536](https://linear.app/pomerium/issue/ENG-3536/bug-http2-stream-terminated-by-rst-stream-with-error-code-no-error)

[ENG-3526](https://linear.app/pomerium/issue/ENG-3526/prod-console-is-not-currently-syncing-to-the-proxy)

## User Explanation

N/A

## Checklist

- [X] reference any related issues
- [x] updated unit tests
- [X] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [x] ready for review

Run Details

52 of 73 new or added lines in 9 files covered. (71.23%)

12 existing lines in 7 files now uncovered.

31468 of 70813 relevant lines covered (44.44%)

115.35 hits per line