5 files changed, 43 insertions, 13 deletions
diff --git a/lib/haproxy.py b/lib/haproxy.py
index 891b418..80745d5 100644
--- a/lib/haproxy.py
+++ b/lib/haproxy.py
@@ -380,6 +380,11 @@ backend backend-{name}
                         utils.package_version('haproxy')
                     ) <= LooseVersion('2.1'):
                         continue
+                    # retries only available from HAProxy 2.1.
+                    if option.split()[0] == 'retries' and LooseVersion(
+                        utils.package_version('haproxy')
+                    ) <= LooseVersion('2.1'):
+                        continue
                     # resolve-* options such as resolve-prefer are only for backend server configs.
                     if option.startswith('resolve-'):
                         continue
diff --git a/reactive/content_cache.py b/reactive/content_cache.py
index 2e174c2..51b8fda 100644
--- a/reactive/content_cache.py
+++ b/reactive/content_cache.py
@@ -400,14 +400,27 @@ def configure_haproxy():  # NOQA: C901 LP#1825084
 
             # Make it more resilient to failures and redispatch requests to different backends.
             found_retry_on = False
+            found_retries = False
             found_redispatch = False
             for opt in new_loc_conf['backend-options']:
                 if opt.startswith('retry-on '):
                     found_retry_on = True
+                elif opt.startswith('retries '):
+                    found_retries = True
                 elif opt.startswith('redispatch '):
                     found_redispatch = True
             if not found_retry_on:
-                new_loc_conf['backend-options'].append('retry-on all-retryable-errors')
+                # all-retryable-errors = "conn-failure", "empty-response", "junk-response", "response-timeout",
+                #                        "0rtt-rejected", "500", "502", "503", and "504"
+                # Instead, use a reduced set
+                # See https://cbonte.github.io/haproxy-dconv/2.4/configuration.html#4-retry-on
+                new_loc_conf['backend-options'].append(
+                    'retry-on conn-failure empty-response response-timeout 502 503 504'
+                )
+            if not found_retries:
+                # Override the default no. of retries from 3
+                # See https://cbonte.github.io/haproxy-dconv/2.4/configuration.html#retries
+                new_loc_conf['backend-options'].append('retries 1')
             if not found_redispatch:
                 new_loc_conf['backend-options'].append('redispatch 1')
 
diff --git a/tests/unit/files/config_test_config.txt b/tests/unit/files/config_test_config.txt
index c7e5e41..19df3fa 100644
--- a/tests/unit/files/config_test_config.txt
+++ b/tests/unit/files/config_test_config.txt
@@ -61,6 +61,7 @@ site3.local:
         - forwardfor except 127.0.0.1 192.168.1.1
         - forceclose
         - retry-on 503 504
+        - retries 2
         - redispatch 3
       cache-maxconn: 4096
 
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output2.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output2.txt
index 0b99f79..639a5f7 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output2.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output2.txt
@@ -108,7 +108,6 @@ backend backend-cached-site1-local
 backend backend-site1-local
     option httpchk HEAD / HTTP/1.1\r\nHost:\ site1.local\r\nUser-Agent:\ haproxy/httpchk
     http-request set-header Host site1.local
-    retries 3
     option redispatch 1
     balance leastconn
     server server_1 192.168.1.1:8080 check inter 5s rise 2 fall 5 maxconn 200
diff --git a/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads_haproxy2.txt b/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads_haproxy2.txt
index e42dd81..5e751f8 100644
--- a/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads_haproxy2.txt
+++ b/tests/unit/files/content_cache_rendered_haproxy_test_output_processes_and_threads_haproxy2.txt
@@ -205,7 +205,8 @@ backend backend-site1-local
     option httpchk HEAD / HTTP/1.1
     http-check send hdr Host site1.local hdr User-Agent haproxy/httpchk
     http-request set-header Host site1.local
-    retry-on all-retryable-errors
+    retry-on conn-failure empty-response response-timeout 502 503 504
+    retries 1
     option redispatch 1
     balance leastconn
     server server_1 127.0.1.10:80 check inter 5s rise 2 fall 5 maxconn 200
@@ -233,7 +234,8 @@ backend backend-site2-local
     http-check send hdr Host site2.local hdr User-Agent haproxy/httpchk
     http-request set-header Host site2.local
     http-request set-header X-Forwarded-For %[src]
-    retry-on all-retryable-errors
+    retry-on conn-failure empty-response response-timeout 502 503 504
+    retries 1
     option redispatch 1
     balance leastconn
     server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 1024 ssl sni str(site2.local) check-sni site2.local verify required ca-file ca-certificates.crt alpn h2,http/1.1 check-alpn http/1.1
@@ -257,6 +259,7 @@ backend backend-site3-local
     option forwardfor except 127.0.0.1 192.168.1.1
     option forceclose
     retry-on 503 504
+    retries 2
     option redispatch 3
     balance leastconn
     server server_1 127.0.1.10:80 check inter 5s rise 2 fall 5 maxconn 200
@@ -287,7 +290,8 @@ backend backend-site5
     option httpchk HEAD / HTTP/1.1
     http-check send hdr Host site5.local hdr User-Agent haproxy/httpchk
     http-request set-header Host site5.local
-    retry-on all-retryable-errors
+    retry-on conn-failure empty-response response-timeout 502 503 504
+    retries 1
     option redispatch 1
     balance leastconn
     server server_1 127.0.1.10:80 check inter 5s rise 2 fall 5 maxconn 200
@@ -296,7 +300,8 @@ backend backend-site5-2
     option httpchk HEAD /status HTTP/1.1
     http-check send hdr Host site5.local hdr User-Agent haproxy/httpchk
     http-request set-header Host site5.local
-    retry-on all-retryable-errors
+    retry-on conn-failure empty-response response-timeout 502 503 504
+    retries 1
     option redispatch 1
     balance leastconn
     server server_1 127.0.1.11:80 check inter 5s rise 2 fall 5 maxconn 200
@@ -315,7 +320,8 @@ backend backend-site6-local
     option httpchk HEAD / HTTP/1.1
     http-check send hdr Host site6.local hdr User-Agent haproxy/httpchk
     http-request set-header Host site6.local
-    retry-on all-retryable-errors
+    retry-on conn-failure empty-response response-timeout 502 503 504
+    retries 1
     option redispatch 1
     balance leastconn
     server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(site6.local) check-sni site6.local verify required ca-file ca-certificates.crt alpn h2,http/1.1 check-alpn http/1.1
@@ -336,7 +342,8 @@ backend backend-site7-local
     option httpchk HEAD / HTTP/1.1
     http-check send hdr Host site7.local hdr User-Agent haproxy/httpchk
     http-request set-header Host site7.local
-    retry-on all-retryable-errors
+    retry-on conn-failure empty-response response-timeout 502 503 504
+    retries 1
     option redispatch 1
     balance leastconn
     server server_1 127.0.1.10:80 check inter 5s rise 2 fall 5 maxconn 200
@@ -357,7 +364,8 @@ backend backend-site8-local
     option httpchk HEAD / HTTP/1.1
     http-check send hdr Host site8.local hdr User-Agent haproxy/httpchk
     http-request set-header Host site8.local
-    retry-on all-retryable-errors
+    retry-on conn-failure empty-response response-timeout 502 503 504
+    retries 1
     option redispatch 1
     balance leastconn
     server server_1 127.0.1.10:80 check inter 5s rise 2 fall 5 maxconn 200
@@ -366,7 +374,8 @@ backend backend-site8-local-2
     option httpchk HEAD / HTTP/1.1
     http-check send hdr Host auth.site8.local hdr User-Agent haproxy/httpchk
     http-request set-header Host auth.site8.local
-    retry-on all-retryable-errors
+    retry-on conn-failure empty-response response-timeout 502 503 504
+    retries 1
     option redispatch 1
     balance leastconn
     server server_1 127.0.1.10:443 check inter 5s rise 2 fall 5 maxconn 200 ssl sni str(auth.site8.local) check-sni auth.site8.local verify required ca-file ca-certificates.crt alpn h2,http/1.1 check-alpn http/1.1
@@ -388,7 +397,8 @@ backend backend-site9-local
     option httpchk HEAD / HTTP/1.1
     http-check send hdr Host site9.local hdr User-Agent haproxy/httpchk
     http-request set-header Host site9.local
-    retry-on all-retryable-errors
+    retry-on conn-failure empty-response response-timeout 502 503 504
+    retries 1
     option redispatch 1
     balance leastconn
     server server_1 127.0.1.15:80 check inter 1m rise 2 fall 5 maxconn 200
@@ -421,7 +431,8 @@ backend backend-site11-local
     http-request set-header Host site11.local
     option forwardfor except 127.0.0.1 192.168.1.1
     option forceclose
-    retry-on all-retryable-errors
+    retry-on conn-failure empty-response response-timeout 502 503 504
+    retries 1
     option redispatch 1
     balance leastconn
     server server_1 127.0.1.10:80 check inter 5s rise 2 fall 5 maxconn 200
@@ -442,7 +453,8 @@ backend backend-site12-local
     option httpchk HEAD / HTTP/1.1
     http-check send hdr Host site12.local hdr User-Agent haproxy/httpchk
     http-request set-header Host site12.local
-    retry-on all-retryable-errors
+    retry-on conn-failure empty-response response-timeout 502 503 504
+    retries 1
     option redispatch 1
     balance leastconn
     server server_1 127.0.1.10:80 check inter 5s rise 2 fall 5 maxconn 200