feat(domaintest): 域名连通性测试套件 + proxy-vs-直连报告, 验证 connect_timeout 5s 修复 - #21
Open
ccijunk wants to merge 5 commits into
Open
feat(domaintest): 域名连通性测试套件 + proxy-vs-直连报告, 验证 connect_timeout 5s 修复#21ccijunk wants to merge 5 commits into
ccijunk wants to merge 5 commits into
Conversation
- ascend_ci_domains.json: ascend CI 白名单 96 条 - test-domains.sh / test-domains-x20.sh / x20-remote.sh: 单次与 ×20 轮压测脚本(经 squid 代理, 采集域名解析 IP + 连通成功率) - REPORT.md / REPORT-x20.md: wlcb(.49) vs gy-001(.37) 域名+IP+可达性报告, 含结构性不可达/间歇性域名/关键修正
4 组合(wlcb/gy-001 × 经squid proxy/直连)每域20轮, 92域全量。 核心: proxy 路径独有劣化(goproxy.cn gy-001 8/20、pytorch-package.obs wlcb 10/20 等), 根因= squid 单IP固定/keep-alive半开复用/超时口径错配; github.com gy-001 两路径0/20 为出口层间歇黑洞, 与 squid 无关。
对照 Squid 7.7 官方文档核实(线上实测 7.7.1): - 根因1改写: squid 有顺序 failover(坏 IP 判死后换下一个), 并非"单IP固定"; 差距在 connect_timeout 2m 判死过慢, 赶不上 curl 6s 预算(合并原1+3为主因) - 次因: positive_dns_ttl(默认6h上限)内坏 IP 被重复首选 - pconn 半开复用降级为存疑: 空闲由 pconn_timeout(默认1min)管而非 read_timeout, NAT idle 回收 <60s 才成立, 需 A/B 验证 - 修复建议勘误: connect_retries 不支持 acl 且管同连接重开(默认不重试); balance_on_multiple_ip 已在 Squid5+ 移除; connect_timeout 建议 3~5s 而非 15s; 新增 forward_max_tries 说明
- 根因: pod 内 127.0.0.1:3128 是 registry-proxy(rpardini nginx), squid 监听 3129 (http_port 3129 ssl-bump); CI 客户端经 Service 3128 被 DNAT 到 3129。 旧版所有 x20/proxy-vs-direct 报告测的是 nginx 出口, 结论无效。 - 脚本: x20-remote.sh / test-domains.sh / test-domains-x20.sh 代理端口改为 3129, x20-remote.sh 增加端口说明注释。 - REPORT-x20.md: 重写为修正版, 新增三集群(gy-001/wlcb-001/gy-002)真实基线: 92 域 0 个全挂, 9 个间歇(全为 CDN 多 IP 偶发抖动); 旧的 "mirrors.ustc/ 123.60.114.225/data.pyg.org/github.com 黑洞" 结论推翻。 - REPORT-proxy-vs-direct.md: 顶部加作废声明, 标注其 3128 分析不适用 squid 路径。
…5s 修复 - 新增 test-proxy-vs-direct-x20.sh: 三集群(gy-001/wlcb-001/gy-002) × 92 域 × 20 轮 proxy(127.0.0.1:3129=squid) + 20 轮直连, 同 pod 同出口对比 - 重写 REPORT-proxy-vs-direct.md: 修正版取代作废的 nginx-3128 版 - 关键结论: connect_timeout 5s 消除系统性 proxy 劣化(goproxy.cn 8/20→20/20); 0 个两路径全挂(github.com gy-001 黑洞恢复); proxy 稳定性反超直连; mirrors.ustc/123.60.114.225 为 squid 503 快速失败(已标注, 非真实可达)
Welcome To opensourceways CommunityHey @ccijunk , thanks for your contribution to the community. Bot Usage ManualI'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands. Contact GuideIf you have any questions, please contact the SIG: infratructure , |
CLA Signature Passccijunk, thanks for your pull request. All authors of the commits have signed the CLA. 👍 |
Linking Issue Notice@ccijunk , the pull request must be linked to at least one issue. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景
Squid + BuildKit + metrics 整套 CI 缓存代理调研中，需要一份"白名单域名在真实 squid 路径下的连通性/Proxy-vs-直连"基线，用于支撑
deploy/chart的配置决策（尤其connect_timeout）。本 PR 内容（新增
domaintest/调研套件）ascend_ci_domains.jsontest-domains.sh/test-domains-x20.sh/x20-remote.sh3129test-proxy-vs-direct-x20.shREPORT.md/REPORT-x20.mdREPORT-proxy-vs-direct.md关键结论
connect_timeout 5s修复实测生效：多 IP 域（goproxy.cn gy-0018/20→20/20、pytorch-package.obs wlcb10/20→19/20、op-svc-swr14/17→20/20）的系统性 proxy 劣化消失，剩余差值 ≤1 次（噪声）。0/20→20/20。3128（registry-proxy nginx）而非 squid3129，本版已用 squid-3129 全量重测；mirrors.ustc.edu.cn/123.60.114.225的 proxy 成功实为 squid 503 快速失败（已在报告中标注，非真实可达）。测试方法
三集群（gy-001 / wlcb-001 / gy-002）
squid-cache-0pod 内kubectl exec，curl-sk --max-time 6，proxy 用127.0.0.1:3129（squidhttp_port 3129 ssl-bump），与直连同 pod 同出口对比。