Timeouts Settings

This reference covers all of Pomerium's Timeouts Settings:

• Allow Websockets
• SPDY
• Route Timeout
• Idle Timeout

Websocket Connections

If set, enables proxying of websocket connections.

warning

Use with caution: websockets are long-lived connections, so global timeouts are not enforced (though the policy-specific timeout is enforced). Allowing websocket connections to the proxy could result in abuse via DOS attacks.

How to configure

Core

YAML/JSON setting	Type	Default
allow_websockets	boolean	false

Examples

allow_websockets: true

Enterprise

Enable Allow Websockets in the Console:

Kubernetes

Annotation name	Type	Default
allow_websockets	boolean, string	false

Examples

ingress.pomerium.io/allow_websockets: 'true'

Enterprise via Terraform

Parameter name	Type	Default
allow_websockets	Boolean	false

Examples

allow_websockets = true

SPDY

If set, SPDY enables proxying of SPDY protocol upgrades.

How to configure

Core

YAML/JSON setting	Type	Default
allow_spdy	boolean	false

Examples

allow_spdy: true

Enterprise

Enable SPDY in the Console:

Kubernetes

Annotation name	Type	Default
allow_spdy	boolean	false

Examples

ingress.pomerium.io/allow_spdy: 'true'

See Kubernetes - Ingress Configuration for more information.

Enterprise via Terraform

YAML/JSON setting	Type	Default
allow_spdy	Boolean	false

Examples

allow_spdy = true

Route Timeout

Route Timeout establishes the per-route timeout value. Cannot exceed global timeout values.

How to configure

Core

YAML/JSON setting	Type	Usage	Default
timeout	string (Go Duration formatting)	optional	30s

Examples

timeout: 30s

Enterprise

Set the Route Timeout in the Console:

Kubernetes

Annotation name	Type	Usage	Default
timeout	string (Go Duration formatting)	optional	30s

Examples

ingress.pomerium.io/timeout: '30s'

Enterprise via Terraform

Parameter name	Type	Usage	Default
timeout	String	optional	30s

Examples

timeout = 30s

Idle Timeout

If you are proxying long-lived requests that employ streaming calls such as websockets or gRPC, set Idle Timeout to either a maximum value there may be no data exchange over a connection (recommended), or set it to unlimited (0s).

If idle_timeout is specified, and route timeout is not explicitly set, then the route timeout would be unlimited (0s). You still may specify maximum lifetime of the connection using the route timeout value (i.e. to 1 day).

How to configure

Core

YAML/JSON setting	Type	Usage	Default
idle_timeout	string (Go Duration formatting)	optional	5m

Examples

routes:
  - from: https://verify.localhost.pomerium.io
    to: http://verify:8000
    timeout: 1m
    idle_timeout: 5m

Enterprise

Set Idle Timeout under route Timeouts settings in the Console:

Kubernetes

Annotation name	Type	Usage	Default
idle_timeout	string (Go Duration formatting)	optional	5m

Examples

ingress.pomerium.io/timeout: '1m'
ingress.pomerium.io/idle_timeout: '5m'

Enterprise via Terraform

Parameter name	Type	Usage	Default
idle_timeout	String	optional	5m

Examples

resource "pomerium_route" "verify_route" { name         = "verify-route" namespace_id = pomerium_namespace.test_namespace.id from         = "https://verify.localhost.pomerium.io" to           = ["https://verify.pomerium.com"] policies     = [pomerium_policy.test_policy.id] idle_timeout = 5m }