From 90409213f8bc558bbbe162f79e71a2c485ae3e09 Mon Sep 17 00:00:00 2001 From: IvanHunters Date: Fri, 7 Aug 2026 16:36:49 +0300 Subject: [PATCH] fix(kube-ovn): bound webhook server request timeouts The webhook http.Server set no read, write, or idle timeout, so a client that opens a connection and sends headers slowly could hold a goroutine and file descriptor indefinitely. Add ReadHeaderTimeout, ReadTimeout, WriteTimeout, and IdleTimeout. Signed-off-by: IvanHunters (cherry picked from commit 4151885871d917f20d3840616045f9c4d45d1f4c) --- .../kubeovn-webhook/images/kubeovn-webhook/main.go | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/packages/system/kubeovn-webhook/images/kubeovn-webhook/main.go b/packages/system/kubeovn-webhook/images/kubeovn-webhook/main.go index a85776c60..7f1d8ec7a 100644 --- a/packages/system/kubeovn-webhook/images/kubeovn-webhook/main.go +++ b/packages/system/kubeovn-webhook/images/kubeovn-webhook/main.go @@ -4,6 +4,7 @@ import ( "flag" "log" "net/http" + "time" ) var ( @@ -33,9 +34,13 @@ func main() { } server := &http.Server{ - Addr: ":8443", - TLSConfig: tlsConfig, - Handler: mux, + Addr: ":8443", + TLSConfig: tlsConfig, + Handler: mux, + ReadHeaderTimeout: 10 * time.Second, + ReadTimeout: 30 * time.Second, + WriteTimeout: 30 * time.Second, + IdleTimeout: 60 * time.Second, } log.Printf("Starting webhook server on %s", server.Addr)