Skip to content

fix(server): Prevent Envoy retries of capacity rejections - #732

Merged
lcian merged 2 commits into
mainfrom
fix/no-envoy-retry-on-capacity
Oct 23, 2026
Merged

lcian merged 2 commits into
mainfrom
fix/no-envoy-retry-on-capacity

Conversation

@sentry-junior

@sentry-junior sentry-junior Bot commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

Since #703, capacity rejections return 503. Our Envoy routes retry on gateway-error, which includes 503. As a result, a saturated instance gets retries of its own rejections.

This PR sets x-envoy-ratelimited: true on rate limit and capacity rejections. Envoy does not retry a response that has this header. Real gateway errors are still retried, and outlier detection still counts the 503s.

Ref FS-577, INC-2579

via async jauer.

--

View Junior Session [Sentry]

Capacity rejections return 503 since #703. The Objectstore Envoy routes
retry 503 under the gateway-error condition, so a saturated instance
receives retries of its own rejections.

Set x-envoy-ratelimited on rate limit and capacity rejections. Envoy
does not retry responses with this header. Outlier detection still
counts the 503.

Co-Authored-By: Jan Michael Auer <jan.auer@sentry.io>
@sentry-junior
sentry-junior Bot requested a review from a team as a code owner October 23, 2026 05:13
@linear-code

linear-code Bot commented Oct 23, 2026 •

Copy link
Copy Markdown

FS-577

INC-2579

@codecov

codecov Bot commented Oct 23, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.91%. Comparing base (2612bee) to head (e898527).

Additional details and impacted files
@@           Coverage Diff           @@
##             main     #732   +/-   ##
=======================================
  Coverage   91.90%   91.91%           
=======================================
  Files         117      117           
  Lines       24131    24141   +10     
=======================================
+ Hits        22178    22189   +11     
+ Misses       1953     1952    -1     
Components Coverage Δ
Rust Backend 94.92% <100.00%> (+<0.01%) ⬆️
Rust Client 82.86% <ø> (ø)
Python Client 93.73% <ø> (ø)

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Make LimitExceeded the single conversion for rate limit and capacity
rejections. Its IntoResponse sets the status and x-envoy-ratelimited.
The extractor rejection, web concurrency middleware, and service
AtCapacity errors all delegate to it.

Co-Authored-By: Jan Michael Auer <jan.auer@sentry.io>
@lcian
lcian merged commit 96d9a96 into main Oct 23, 2026
25 checks passed
@lcian
lcian deleted the fix/no-envoy-retry-on-capacity branch October 23, 2026 08:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants