docs(observability-proxy): say what the request timeout bounds

The flag now also bounds the body read and the token and access
reviews, and 0 lifts all of those at once; an operator raising it for
slow store queries needs to know that. The store comment named a
design document the repository does not have.

Assisted-by: LLM
Signed-off-by: ZverGuy <maximbel2003@gmail.com>

cmd/observability-proxy/main.go

@@ -69,7 +69,7 @@ func parseFlags(args []string) (options, error) {
 	fs.StringVar(&o.rootTenant, "root-tenant", "tenant-root", "tenant namespace hosting the default store")
 	fs.StringVar(&o.kubeconfig, "kubeconfig", "", "kubeconfig path; in-cluster config when empty")
 	fs.DurationVar(&o.authCacheTTL, "auth-cache-ttl", 10*time.Second, "how long TokenReview and SubjectAccessReview answers are cached")
-	fs.DurationVar(&o.requestTimeout, "request-timeout", time.Minute, "upstream deadline for every endpoint but tail")
+	fs.DurationVar(&o.requestTimeout, "request-timeout", time.Minute, "deadline for reading the request body, the token and access reviews, and every upstream endpoint but tail; 0 disables it")
 	fs.DurationVar(&o.tailIdleTimeout, "tail-idle-timeout", 5*time.Minute, "close a tail after this long without a line")
 	fs.DurationVar(&o.shutdownTimeout, "shutdown-timeout", 15*time.Second, "grace period for in-flight requests on shutdown")
 	fs.DurationVar(&o.logs.DefaultRange, "logs-default-range", time.Hour, "window used when a logs request has no start")

internal/observabilityproxy/store.go

@@ -48,7 +48,7 @@ func NewStoreResolver(namespaces corev1listers.NamespaceLister, synced func() bo
 // Resolve answers the root tenant for a namespace that no longer exists,
 // because its label went with it. Lines it wrote while routed to another
 // tenant's store are not found there; reading them needs routing history
-// (an open question of the design).
+// the proxy does not keep.
 func (r *StoreResolver) Resolve(namespace string) (string, error) {
 	// Before the first list every namespace looks gone, which would send
 	// a labeled one to the root store; readiness alone does not stop a