agent: add disable_keep_alives configurable

api/client.go

@@ -756,6 +756,24 @@ func (c *Client) MaxIdleConnections() int {
 	return c.config.HttpClient.Transport.(*http.Transport).MaxIdleConns
 }
 
+func (c *Client) SetDisableKeepAlives(disable bool) {
+	c.modifyLock.RLock()
+	defer c.modifyLock.RUnlock()
+	c.config.modifyLock.Lock()
+	defer c.config.modifyLock.Unlock()
+
+	c.config.HttpClient.Transport.(*http.Transport).DisableKeepAlives = disable
+}
+
+func (c *Client) DisableKeepAlives() bool {
+	c.modifyLock.RLock()
+	defer c.modifyLock.RUnlock()
+	c.config.modifyLock.RLock()
+	defer c.config.modifyLock.RUnlock()
+
+	return c.config.HttpClient.Transport.(*http.Transport).DisableKeepAlives
+}
+
 func (c *Client) MaxRetries() int {
 	c.modifyLock.RLock()
 	defer c.modifyLock.RUnlock()

changelog/16479.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+agent: Added `disable_keep_alives` configuration to disable keep alives in auto-auth, caching and templating.
+```

command/agent.go

@@ -379,6 +379,10 @@ func (c *AgentCommand) Run(args []string) int {
 			sinkClient.SetMaxIdleConnections(-1)
 		}
 
+		if config.DisableKeepAlivesAutoAuth {
+			sinkClient.SetDisableKeepAlives(true)
+		}
+
 		for _, sc := range config.AutoAuth.Sinks {
 			switch sc.Type {
 			case "file":
@@ -507,10 +511,14 @@ func (c *AgentCommand) Run(args []string) int {
 			return 1
 		}
 
-		if config.DisableIdleConnsAutoAuth {
+		if config.DisableIdleConnsCaching {
 			proxyClient.SetMaxIdleConnections(-1)
 		}
 
+		if config.DisableKeepAlivesCaching {
+			proxyClient.SetDisableKeepAlives(true)
+		}
+
 		// Create the API proxier
 		apiProxy, err := cache.NewAPIProxy(&cache.APIProxyConfig{
 			Client:                 proxyClient,
@@ -824,6 +832,10 @@ func (c *AgentCommand) Run(args []string) int {
 			ahClient.SetMaxIdleConnections(-1)
 		}
 
+		if config.DisableKeepAlivesAutoAuth {
+			ahClient.SetDisableKeepAlives(true)
+		}
+
 		ah := auth.NewAuthHandler(&auth.AuthHandlerConfig{
 			Logger:                       c.logger.Named("auth.handler"),
 			Client:                       ahClient,

command/agent/config/config.go

@@ -24,19 +24,26 @@ import (
 type Config struct {
 	*configutil.SharedConfig `hcl:"-"`
 
-	AutoAuth                   *AutoAuth                  `hcl:"auto_auth"`
-	ExitAfterAuth              bool                       `hcl:"exit_after_auth"`
-	Cache                      *Cache                     `hcl:"cache"`
-	Vault                      *Vault                     `hcl:"vault"`
-	TemplateConfig             *TemplateConfig            `hcl:"template_config"`
-	Templates                  []*ctconfig.TemplateConfig `hcl:"templates"`
-	DisableIdleConns           []string                   `hcl:"disable_idle_connections"`
-	DisableIdleConnsCaching    bool                       `hcl:"-"`
-	DisableIdleConnsTemplating bool                       `hcl:"-"`
-	DisableIdleConnsAutoAuth   bool                       `hcl:"-"`
+	AutoAuth                    *AutoAuth                  `hcl:"auto_auth"`
+	ExitAfterAuth               bool                       `hcl:"exit_after_auth"`
+	Cache                       *Cache                     `hcl:"cache"`
+	Vault                       *Vault                     `hcl:"vault"`
+	TemplateConfig              *TemplateConfig            `hcl:"template_config"`
+	Templates                   []*ctconfig.TemplateConfig `hcl:"templates"`
+	DisableIdleConns            []string                   `hcl:"disable_idle_connections"`
+	DisableIdleConnsCaching     bool                       `hcl:"-"`
+	DisableIdleConnsTemplating  bool                       `hcl:"-"`
+	DisableIdleConnsAutoAuth    bool                       `hcl:"-"`
+	DisableKeepAlives           []string                   `hcl:"disable_keep_alives"`
+	DisableKeepAlivesCaching    bool                       `hcl:"-"`
+	DisableKeepAlivesTemplating bool                       `hcl:"-"`
+	DisableKeepAlivesAutoAuth   bool                       `hcl:"-"`
 }
 
-const DisableIdleConnsEnv = "VAULT_AGENT_DISABLE_IDLE_CONNECTIONS"
+const (
+	DisableIdleConnsEnv  = "VAULT_AGENT_DISABLE_IDLE_CONNECTIONS"
+	DisableKeepAlivesEnv = "VAULT_AGENT_DISABLE_KEEP_ALIVES"
+)
 
 func (c *Config) Prune() {
 	for _, l := range c.Listeners {
@@ -288,6 +295,28 @@ func LoadConfig(path string) (*Config, error) {
 		}
 	}
 
+	if disableKeepAlivesEnv := os.Getenv(DisableKeepAlivesEnv); disableKeepAlivesEnv != "" {
+		result.DisableKeepAlives, err = parseutil.ParseCommaStringSlice(strings.ToLower(disableKeepAlivesEnv))
+		if err != nil {
+			return nil, fmt.Errorf("error parsing environment variable %s: %v", DisableKeepAlivesEnv, err)
+		}
+	}
+
+	for _, subsystem := range result.DisableKeepAlives {
+		switch subsystem {
+		case "auto-auth":
+			result.DisableKeepAlivesAutoAuth = true
+		case "caching":
+			result.DisableKeepAlivesCaching = true
+		case "templating":
+			result.DisableKeepAlivesTemplating = true
+		case "":
+			continue
+		default:
+			return nil, fmt.Errorf("unknown disable_keep_alives value: %s", subsystem)
+		}
+	}
+
 	return result, nil
 }