Skip to content

Client side throttling with many secrets and low refresh interval #1336

@bobbywatson3

Description

@bobbywatson3

Describe the solution you'd like
On our cluster with ~1,800 external-secrets set at approximately 15s refreshInterval, we frequently see secrets taking minutes to sync, and the following errors (in between successul syncs) in the logs:

I0707 17:40:58.294661       1 request.go:665] Waited for 49.945948656s due to client-side throttling, not priority and fairness, request: GET:https://172.20.0.1:443/api/v1/namespaces/foo/secrets/bar-secrets

Even with concurrency set to a high value like 1,000, we can't get around this throttling. Is it possible to configure the client side rate limiter? The kube go-client has the config here. I think the external-secrets operator would need to be configured here. (Thanks @gusfcarvalho for help finding this)

This is with release v0.5.5.

What is the added value?
This would allow clusters with more sync traffic to maintain performant secret syncs.

Observations (Constraints, Context, etc):

Even with this traffic, resource utilization on the pods was very low at around 100mCPU and 220MiB of memory.

Metadata

Metadata

Assignees

No one assigned

    Labels

    area/lifecycleIndicates an issue related to the lifecycle of secretskind/bugCategorizes issue or PR as related to a bug.

    Type

    No type

    Projects

    Status

    Done

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions