Skip to content

Commit

Permalink
Reduce the client TLS session cache size
Browse files Browse the repository at this point in the history
We've seen heap dumps with ~500mb of tls session cache despite an
expectation that connections are reused. These large session caches seem
to show that we are creating new sessions anyhow, so there's little
point in caching old data.
  • Loading branch information
carterkozak committed Nov 29, 2020
1 parent 90bbdd5 commit 120b90a
Showing 1 changed file with 9 additions and 0 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@
import com.palantir.tritium.metrics.registry.TaggedMetricRegistry;
import java.security.Provider;
import java.util.Optional;
import javax.net.ssl.SSLContext;
import org.immutables.value.Value;

/**
Expand Down Expand Up @@ -64,6 +65,14 @@ static ClientConfiguration getClientConf(ServiceConfiguration serviceConfig, Aug
ClientConfiguration.Builder builder =
ClientConfiguration.builder().from(ClientConfigurations.of(serviceConfig));

SSLContext context = augment.securityProvider()
.map(provider -> SslSocketFactories.createSslContext(serviceConfig.security(), provider))
.orElseGet(() -> SslSocketFactories.createSslContext(serviceConfig.security()));
// Reduce the session cache size for clients. We expect TLS connections to be reused, thus the cache isn't
// terribly important.
context.getClientSessionContext().setSessionCacheSize(100);
builder.sslSocketFactory(context.getSocketFactory());

if (!serviceConfig.maxNumRetries().isPresent()) {
augment.maxNumRetries().ifPresent(builder::maxNumRetries);
}
Expand Down

0 comments on commit 120b90a

Please sign in to comment.