DigitalOcean Loadbalancer: Slow TCP connections when traffic is higher2019 Community Moderator ElectionHAProxy Loadbalancing TCP trafficKubernetes exposed LoadBalancer service is very slowHTTPS request hangs indefinitelyHow Can I Make Https Health Checks based on IP?Some kubectl commands not working when K8S cluster is initialized with self-generated apiserver-kubelet-client.crt certificateIs it possible to access the Kubernetes API via https ingress?Gunicorn Two-way SSL Error “SSL_ERROR_UNKNOWN_CA_ALERT”digitalocean kubernetes loadbalancerDigitalOcean Kubernetes Loadbalancer IP with my domain namePre-deploying Kubernetes loadbalancer with terraform on DigitalOcean?
What has been your most complicated TikZ drawing?
Why do passenger jet manufacturers design their planes with stall prevention systems?
Why did it take so long to abandon sail after steamships were demonstrated?
Humanity loses the vast majority of its technology, information, and population in the year 2122. How long does it take to rebuild itself?
What is a good source for large tables on the properties of water?
SQL Server Primary Login Restrictions
Is it normal that my co-workers at a fitness company criticize my food choices?
Can the damage from a Talisman of Pure Good (or Ultimate Evil) be non-lethal?
Happy pi day, everyone!
Counting certain elements in lists
Brexit - No Deal Rejection
Pinhole Camera with Instant Film
Rules about breaking the rules. How do I do it well?
Life insurance that covers only simultaneous/dual deaths
Ban on all campaign finance?
What are the possible solutions of the given equation?
Bash replace string at multiple places in a file from command line
Identifying the interval from A♭ to D♯
What does it mean to make a bootable LiveUSB?
PTIJ: Who should pay for Uber rides: the child or the parent?
How could a scammer know the apps on my phone / iTunes account?
Fill color and outline color with the same value
Could the Saturn V actually have launched astronauts around Venus?
Font with correct density?
DigitalOcean Loadbalancer: Slow TCP connections when traffic is higher
2019 Community Moderator ElectionHAProxy Loadbalancing TCP trafficKubernetes exposed LoadBalancer service is very slowHTTPS request hangs indefinitelyHow Can I Make Https Health Checks based on IP?Some kubectl commands not working when K8S cluster is initialized with self-generated apiserver-kubelet-client.crt certificateIs it possible to access the Kubernetes API via https ingress?Gunicorn Two-way SSL Error “SSL_ERROR_UNKNOWN_CA_ALERT”digitalocean kubernetes loadbalancerDigitalOcean Kubernetes Loadbalancer IP with my domain namePre-deploying Kubernetes loadbalancer with terraform on DigitalOcean?
Edit This question used to be focused on the Kubernetes side of things. It is now apparent that the problem is at the Digitalocean Loadbalancer level.
I'm in the process of moving our service from Docker Swarm to a Kubernetes setup. The new K8S environment is up and running and I am starting to switch over traffic to the new K8S setup. However, when the traffic seems to be ramping up, it slows to a halt. The browser just spins for a while and then it loads snappily.
Running a simple curl -vvv https://thehostname.com and this happens
* Trying 12.123.123.123...
* Connected to thehostname.com (12.123.123.123) port 443 (#0)
* found 148 certificates in /etc/ssl/certs/ca-certificates.crt
* found 594 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
Then it pauses on that line for a while and after around 30 seconds it loads the rest of the request.
The symptom is that when the amount of traffic increases, the response time increases. It starts at 0.5 seconds, and then steadily increases to 30 seconds and is caped there. When I turn off traffic, the response time goes back to normal. The number of requests per second isn't more than 20-30 at most when this starts happening.
It seems that the act of opening a TCP connection is the slow part. I'm in contact with DigitalOcean support, but so far it has not yielded anything as it probably needs to be escalated.
ssl
kubernetes digital-ocean haproxy nginx-ingress asked Feb 21 at 19:00
Erik RothoffErik Rothoff
2,01243447
add a comment |
Edit This question used to be focused on the Kubernetes side of things. It is now apparent that the problem is at the Digitalocean Loadbalancer level.
I'm in the process of moving our service from Docker Swarm to a Kubernetes setup. The new K8S environment is up and running and I am starting to switch over traffic to the new K8S setup. However, when the traffic seems to be ramping up, it slows to a halt. The browser just spins for a while and then it loads snappily.
Running a simple curl -vvv https://thehostname.com and this happens
* Trying 12.123.123.123...
* Connected to thehostname.com (12.123.123.123) port 443 (#0)
* found 148 certificates in /etc/ssl/certs/ca-certificates.crt
* found 594 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
Then it pauses on that line for a while and after around 30 seconds it loads the rest of the request.
The symptom is that when the amount of traffic increases, the response time increases. It starts at 0.5 seconds, and then steadily increases to 30 seconds and is caped there. When I turn off traffic, the response time goes back to normal. The number of requests per second isn't more than 20-30 at most when this starts happening.
It seems that the act of opening a TCP connection is the slow part. I'm in contact with DigitalOcean support, but so far it has not yielded anything as it probably needs to be escalated.
ssl
kubernetes digital-ocean haproxy nginx-ingress asked Feb 21 at 19:00
Erik RothoffErik Rothoff
2,01243447
add a comment |
Edit This question used to be focused on the Kubernetes side of things. It is now apparent that the problem is at the Digitalocean Loadbalancer level.
I'm in the process of moving our service from Docker Swarm to a Kubernetes setup. The new K8S environment is up and running and I am starting to switch over traffic to the new K8S setup. However, when the traffic seems to be ramping up, it slows to a halt. The browser just spins for a while and then it loads snappily.
Running a simple curl -vvv https://thehostname.com and this happens
* Trying 12.123.123.123...
* Connected to thehostname.com (12.123.123.123) port 443 (#0)
* found 148 certificates in /etc/ssl/certs/ca-certificates.crt
* found 594 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
Then it pauses on that line for a while and after around 30 seconds it loads the rest of the request.
The symptom is that when the amount of traffic increases, the response time increases. It starts at 0.5 seconds, and then steadily increases to 30 seconds and is caped there. When I turn off traffic, the response time goes back to normal. The number of requests per second isn't more than 20-30 at most when this starts happening.
It seems that the act of opening a TCP connection is the slow part. I'm in contact with DigitalOcean support, but so far it has not yielded anything as it probably needs to be escalated.
ssl
kubernetes digital-ocean haproxy nginx-ingress asked Feb 21 at 19:00
Erik RothoffErik Rothoff
2,01243447
Edit This question used to be focused on the Kubernetes side of things. It is now apparent that the problem is at the Digitalocean Loadbalancer level.
I'm in the process of moving our service from Docker Swarm to a Kubernetes setup. The new K8S environment is up and running and I am starting to switch over traffic to the new K8S setup. However, when the traffic seems to be ramping up, it slows to a halt. The browser just spins for a while and then it loads snappily.
Running a simple curl -vvv https://thehostname.com and this happens
* Trying 12.123.123.123...
* Connected to thehostname.com (12.123.123.123) port 443 (#0)
* found 148 certificates in /etc/ssl/certs/ca-certificates.crt
* found 594 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
Then it pauses on that line for a while and after around 30 seconds it loads the rest of the request.
The symptom is that when the amount of traffic increases, the response time increases. It starts at 0.5 seconds, and then steadily increases to 30 seconds and is caped there. When I turn off traffic, the response time goes back to normal. The number of requests per second isn't more than 20-30 at most when this starts happening.
It seems that the act of opening a TCP connection is the slow part. I'm in contact with DigitalOcean support, but so far it has not yielded anything as it probably needs to be escalated.
ssl
kubernetes digital-ocean haproxy nginx-ingress ssl
kubernetes digital-ocean haproxy nginx-ingress asked Feb 21 at 19:00
Erik RothoffErik Rothoff
2,01243447
asked Feb 21 at 19:00
Erik RothoffErik Rothoff
2,01243447
edited Mar 7 at 12:18
Erik Rothoff
asked Feb 21 at 19:00
Erik RothoffErik Rothoff
2,01243447
asked Feb 21 at 19:00
Erik RothoffErik Rothoff
2,01243447
asked Feb 21 at 19:00
Erik RothoffErik Rothoff
2,01243447
2,01243447
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Issue most likely is with the number of certificates in /etc/ssl/certs.
It says that 594, certs are found. Do you really need all of them. Validate them and remove unwanted ones. Also try to copy all certs into file instead of maintaining one file for each cert
answered Feb 21 at 19:13
P EkambaramP Ekambaram
1,242616
This is something that happens in different browsers on different machines, Pingdom sees the 30 second requests and times out, my local machine, etc. This example just happened to run on a webserver with a lot of certificates. So I doubt it has anything to do with it? Or am I missing something?
– Erik Rothoff
Feb 21 at 21:17
add a comment |
Your Answer
StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54814360%2fdigitalocean-loadbalancer-slow-tcp-connections-when-traffic-is-higher%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Issue most likely is with the number of certificates in /etc/ssl/certs.
It says that 594, certs are found. Do you really need all of them. Validate them and remove unwanted ones. Also try to copy all certs into file instead of maintaining one file for each cert
answered Feb 21 at 19:13
P EkambaramP Ekambaram
1,242616
This is something that happens in different browsers on different machines, Pingdom sees the 30 second requests and times out, my local machine, etc. This example just happened to run on a webserver with a lot of certificates. So I doubt it has anything to do with it? Or am I missing something?
– Erik Rothoff
Feb 21 at 21:17
add a comment |
Issue most likely is with the number of certificates in /etc/ssl/certs.
It says that 594, certs are found. Do you really need all of them. Validate them and remove unwanted ones. Also try to copy all certs into file instead of maintaining one file for each cert
answered Feb 21 at 19:13
P EkambaramP Ekambaram
1,242616
This is something that happens in different browsers on different machines, Pingdom sees the 30 second requests and times out, my local machine, etc. This example just happened to run on a webserver with a lot of certificates. So I doubt it has anything to do with it? Or am I missing something?
– Erik Rothoff
Feb 21 at 21:17
add a comment |
Issue most likely is with the number of certificates in /etc/ssl/certs.
It says that 594, certs are found. Do you really need all of them. Validate them and remove unwanted ones. Also try to copy all certs into file instead of maintaining one file for each cert
answered Feb 21 at 19:13
P EkambaramP Ekambaram
1,242616
Issue most likely is with the number of certificates in /etc/ssl/certs.
It says that 594, certs are found. Do you really need all of them. Validate them and remove unwanted ones. Also try to copy all certs into file instead of maintaining one file for each cert
answered Feb 21 at 19:13
P EkambaramP Ekambaram
1,242616
answered Feb 21 at 19:13
P EkambaramP Ekambaram
1,242616
answered Feb 21 at 19:13
P EkambaramP Ekambaram
1,242616
answered Feb 21 at 19:13
P EkambaramP Ekambaram
1,242616
1,242616
This is something that happens in different browsers on different machines, Pingdom sees the 30 second requests and times out, my local machine, etc. This example just happened to run on a webserver with a lot of certificates. So I doubt it has anything to do with it? Or am I missing something?
– Erik Rothoff
Feb 21 at 21:17
add a comment |
This is something that happens in different browsers on different machines, Pingdom sees the 30 second requests and times out, my local machine, etc. This example just happened to run on a webserver with a lot of certificates. So I doubt it has anything to do with it? Or am I missing something?
– Erik Rothoff
Feb 21 at 21:17
This is something that happens in different browsers on different machines, Pingdom sees the 30 second requests and times out, my local machine, etc. This example just happened to run on a webserver with a lot of certificates. So I doubt it has anything to do with it? Or am I missing something?
– Erik Rothoff
Feb 21 at 21:17
This is something that happens in different browsers on different machines, Pingdom sees the 30 second requests and times out, my local machine, etc. This example just happened to run on a webserver with a lot of certificates. So I doubt it has anything to do with it? Or am I missing something?
– Erik Rothoff
Feb 21 at 21:17
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54814360%2fdigitalocean-loadbalancer-slow-tcp-connections-when-traffic-is-higher%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
