The Cache-Control header of cdn.dl.k8s.io contains 'no-store', disabling caching completely.

[ysiw]

$ curl --head https://cdn.dl.k8s.io/release/v1.30.0/kubernetes-server-linux-amd64.tar.gz
HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 376899698
Content-Type: application/x-tar
Last-Modified: Wed, 17 Apr 2024 21:23:20 GMT
ETag: "7cf058a841717952027d751c6fd7adaf"
Accept-Ranges: bytes
Age: 79750
Date: Sat, 31 May 2025 11:49:33 GMT
Cache-Control: private, no-store
access-control-allow-origin: *

[BenTheElder]

cc @ameukam

[BenTheElder]

/sig k8s-infra

[ameukam]

we don't cache the HEAD requests to at the edge network per recommendation of the CDN provider and to avoid unnecessary caching.

[BenTheElder]

I think the issue is the header is being reflected from the edge to the client, but the client should be allowed to cache?

It makes sense to set this between the edge and backend as needed, but the edge should probably not prohibit the client caching.

[BenTheElder]

/kind bug

[BenTheElder]

@ameukam since you set this up: #8151 (comment) ?

[ysiw]

we don't cache the HEAD requests to at the edge network per recommendation of the CDN provider and to avoid unnecessary caching.

@ameukam same issue for GET requests

C:\>curl -D - --get https://cdn.dl.k8s.io/release/v1.30.0/kubernetes-server-linux-amd64.tar.gz
HTTP/1.1 200 OK
Connection: keep-alive
Content-Length: 376899698
Content-Type: application/x-tar
Last-Modified: Wed, 17 Apr 2024 21:23:20 GMT
ETag: "7cf058a841717952027d751c6fd7adaf"
Accept-Ranges: bytes
Age: 411868
Date: Tue, 12 Aug 2025 08:02:38 GMT
Cache-Control: private, no-store
access-control-allow-origin: *

Warning: Binary output can mess up your terminal. Use "--output -" to tell
Warning: curl to output it to your terminal anyway, or consider "--output
Warning: <FILE>" to save to a file.

C:\>

[ameukam]

It's unclear to me from the output if the cache is disabled. Cache-Control: private, no-store means caching is done at the edge network; not we disable the cache.
I'm not able to reproduce this. Do you mind run:
curl -v -D -H"k8s-io-8151:1" -H"fastly-debug:1" --get https://cdn.dl.k8s.io/release/v1.30.0/kubernetes-server-linux-amd64.tar.gz ?

[ameukam]

@ameukam since you set this up: #8151 (comment) ?

Only the max-age, s-maxage, and private Cache-Control directives will influence Fastly's caching. All other Cache-Control directives will not, but will be passed through to the browser.

https://www.fastly.com/documentation/guides/full-site-delivery/caching/caching-best-practices/#cache-control-directives

@BenTheElder the config reported is not really affecting Fastly cache config ?

[BenTheElder]

@BenTheElder the config reported is not really affecting Fastly cache config ?

Caching also exists in the clients, we are instructing clients not to cache either.

We would ideally tell fastly what caching we want at the edge independently of the headers that reach clients.

You can test like:
curl -v https://cdn.dl.k8s.io/release/v1.30.0/kubernetes-server-linux-amd64.tar.gz on mac / linux and see the caching headers the client receives

[BenTheElder]

Though I have no idea what clients would actually try to cache files this large, maybe a mirroring tool?

@ysiw do you have more on impacted use-cases, or is this more "technically incorrect"?

We all have a lot of things to work on in the project 😓