Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 1513139 - Client side rate limiting makes migrations excessively long for large clusters
Summary: Client side rate limiting makes migrations excessively long for large clusters
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Auth
Version: 3.7.1
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
: 3.7.z
Assignee: Mo
QA Contact: scheng
Depends On:
Blocks: 1539855 1539857 1539859
TreeView+ depends on / blocked
Reported: 2017-11-14 19:45 UTC by Justin Pierce
Modified: 2018-04-05 09:32 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1539855 1539857 1539859 (view as bug list)
Last Closed: 2018-04-05 09:32:08 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:0636 None None None 2018-04-05 09:32:45 UTC

Description Justin Pierce 2017-11-14 19:45:23 UTC
Description of problem:
`oadm migration authorization` is going to take over 5 hours for a single large cluster (~22000 projects). The majority of this time will be spent in rate limiting logic in the client (200ms for rate limit vs 10ms for the request itself).

Version-Release number of selected component (if applicable):

How reproducible:

Expected results:
Rate limiting should be a user choice and likely not the default for operations required for upgrades. A 5 hour pre-check is a sizable impediment to a predictable upgrade. 

Can we turn this off for migrate or make a general purpose --no-rate-limit CLI flag? If an authenticated user wants to intentionally DOS attack the server, they can do so without using the CLI. Only a well intentioned user would bother using the CLI and, if they know what they are doing and opt in with the flag, we should let them migrate quickly.

Comment 5 Mike Fiedler 2018-02-05 19:49:13 UTC
Tested the following clients against a server:

For 1000 projects oc adm migrate authorization time was reduced from 14 minutes (pre-fix client - to 6-7 seconds.   The 14 minutes is inline with the estimate above of 5 hours for 20K projects

For 20000 projects, migration time with the fix was ~ 2m 20s for all versions of the fixed client. 

This can be marked VERIFIED once a functional team regression of the command is performed.

Comment 6 scheng 2018-02-06 02:59:39 UTC
Verified,no issue found.

Comment 10 errata-xmlrpc 2018-04-05 09:32:08 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

Note You need to log in before you can comment on or make changes to this bug.