Timeouts Settings

This reference covers all of Pomerium's Timeouts Settings:

• Allow Websockets
• SPDY
• Route Timeout
• Idle Timeout

Websocket Connections

If set, enables proxying of websocket connections.

danger

Use with caution: websockets are long-lived connections, so global timeouts are not enforced (though the policy-specific timeout is enforced). Allowing websocket connections to the proxy could result in abuse via DOS attacks.

How to configure

YAML/JSON setting	Type	Default
allow_websockets	boolean	false

Enable Allow Websockets in the Console:

Name	Type	Default
allow_websockets	boolean	false

See Kubernetes Ingress for more information

Examples

allow_websockets: true

SPDY

If set, SPDY enables proxying of SPDY protocol upgrades.

How to configure

YAML/JSON setting	Type	Default
allow_spdy	boolean	false

Enable SPDY in the Console:

Name	Type	Default
allow_spdy	boolean	false

See Kubernetes Ingress for information

Examples

allow_spdy: true

Route Timeout

Route Timeout establishes the per-route timeout value. Cannot exceed global timeout values.

How to configure

YAML/JSON setting	Type	Usage	Default
timeout	string (Go Duration formatting)	optional	30s

Set the Route Timeout in the Console:

Name	Type	Usage	Default
timeout	string (Go Duration formatting)	optional	30s

See Kubernetes Ingress for more information

Examples

timeout: 30s

Idle Timeout

If you are proxying long-lived requests that employ streaming calls such as websockets or gRPC, set Idle Timeout to either a maximum value there may be no data exchange over a connection (recommended), or set it to unlimited (0s).

If idle_timeout is specified, and route timeout is not explicitly set, then the route timeout would be unlimited (0s). You still may specify maximum lifetime of the connection using the route timeout value (i.e. to 1 day).

How to configure

YAML/JSON setting	Type	Usage	Default
idle_timeout	string (Go Duration formatting)	optional	5m

Set Idle Timeout under route Timeouts settings in the Console:

See the Kubernetes Ingress - Pomerium Standard Annotations section for more information.

routes:
  - from: https://verify.localhost.pomerium.io
    to: http://verify:8000
    timeout: 1m
    idle_timeout: 5m