Timeouts Settings

This reference covers all of Pomerium's Timeouts Settings:

• Allow Websockets
• SPDY
• Route Timeout
• Idle Timeout

Websocket Connections

If set, enables proxying of websocket connections.

warning

Use with caution: websockets are long-lived connections, so both the route timeout and idle timeout are automatically disabled (set to 0) unless explicitly configured. Allowing websocket connections to the proxy could result in abuse via DOS attacks.

How to configure

Core

YAML/JSON setting	Type	Default
allow_websockets	boolean	false

Examples

allow_websockets: true

Enterprise

Enable Allow Websockets in the Console:

The allow_websockets setting can also be configured by Terraform.

Kubernetes

Annotation name	Type	Default
allow_websockets	boolean, string	false

Examples

ingress.pomerium.io/allow_websockets: 'true'

SPDY

If set, SPDY enables proxying of SPDY protocol upgrades.

How to configure

Core

YAML/JSON setting	Type	Default
allow_spdy	boolean	false

Examples

allow_spdy: true

Enterprise

Enable SPDY in the Console:

The allow_spdy setting can also be configured by Terraform.

Kubernetes

Annotation name	Type	Default
allow_spdy	boolean	false

Examples

ingress.pomerium.io/allow_spdy: 'true'

See Kubernetes - Ingress Configuration for more information.

Route Timeout

Route Timeout establishes the per-route timeout value. Cannot exceed global timeout values. If unset, the route inherits the global default_upstream_timeout (default 30s).

For routes with websockets enabled, or for TCP, UDP, and Kubernetes routes, the route timeout is automatically set to 0 (disabled) unless explicitly configured via this setting.

How to configure

Core

YAML/JSON setting	Type	Usage	Default
timeout	string (Go Duration formatting)	optional	30s

Examples

timeout: 30s

Enterprise

Set the Route Timeout in the Console:

The timeout setting can also be configured by Terraform.

Kubernetes

Annotation name	Type	Usage	Default
timeout	string (Go Duration formatting)	optional	30s

Examples

ingress.pomerium.io/timeout: '30s'

Idle Timeout

If you are proxying long-lived requests that employ streaming calls such as websockets or gRPC, set Idle Timeout to either a maximum value there may be no data exchange over a connection (recommended), or set it to unlimited (0s).

If idle_timeout is specified, and route timeout is not explicitly set, then the route timeout would be unlimited (0s). You still may specify maximum lifetime of the connection using the route timeout value (i.e. to 1 day).

For routes with websockets enabled, or for TCP, UDP, and Kubernetes routes, the idle timeout is automatically set to 0 (disabled) unless explicitly configured via this setting.

How to configure

Core

YAML/JSON setting	Type	Usage	Default
idle_timeout	string (Go Duration formatting)	optional	not set

Examples

routes:
  - from: https://verify.localhost.pomerium.io
    to: http://verify:8000
    timeout: 1m
    idle_timeout: 5m

Enterprise

Set Idle Timeout under route Timeouts settings in the Console:

The idle_timeout setting can also be configured by Terraform.

Kubernetes

Annotation name	Type	Usage	Default
idle_timeout	string (Go Duration formatting)	optional	not set

Examples

ingress.pomerium.io/timeout: '1m'
ingress.pomerium.io/idle_timeout: '5m'