chore(feed): cap exponential backoff

[dcaravel]

The backoff introduced is a bit 'too exponential' when retries were increased, this change caps backoff to 5 mins

ex:

... retrying in 42m40s

time="2026-07-01T13:32:06Z" level=warning msg="Feed year 2024: attempt 9 failed: reading feed body (read 93318053 bytes, elapsed: 6m26.142596235s): stream error: stream ID 1; INTERNAL_ERROR; received from peer; retrying in 42m40s"

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 5736c58d-e3f4-4189-adcc-01c283824e7b

📥 Commits

Reviewing files that changed from the base of the PR and between e979d9c and ffd9110.

📒 Files selected for processing (1)

• pkg/vulnloader/nvdloader/loader_feed.go

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Improved feed download retry handling with clearer, fixed wait intervals between attempts.
  • Added more predictable retry logging so download failures are easier to follow.
  • Preserved existing retry limits and overall feed processing behavior.

Walkthrough

Modified the retry/backoff logic in downloadFeedForYear for NVD feed downloads. Replaced the exponential backoff (starting at 10s, doubling per retry) with a fixed sequence of delays (15s, 30s, 1m, 2m, 4m, 5m), selecting the delay per attempt from this predefined slice.

Changes

Retry Backoff Schedule

Layer / File(s)	Summary
Fixed backoff delay sequence pkg/vulnloader/nvdloader/loader_feed.go	Replaces exponential backoff with a fixed backoffs slice (15s, 30s, 1m, 2m, 4m, 5m) and updates the retry loop to select the delay per attempt via min(attempt-1, len(backoffs)-1), then logs and sleeps for that duration.

Estimated code review effort: 2 (Simple) | ~10 minutes

Related PRs: None found.

Suggested labels: None

Suggested reviewers: None

🐰 A rabbit hops with steady pace,
No more doubling, wild-paced race—
Fifteen seconds, then thirty more,
Fixed delays it won't ignore,
Retry gently, five minutes' grace.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: capping the feed retry backoff.
Description check	✅ Passed	The description directly explains the backoff cap and the reason for the change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dc/nvd-reduce-backoff

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jvdm]

Given how sensitive NVD's availability is to request rates, and since they've explicitly acknowledged performance issues in the past, do you think it would make sense to back off for longer periods of time?

backoffs := []time.Duration{
    15 * time.Second,
    30 * time.Second,
    1 * time.Minute,
    2 * time.Minute,
    4 * time.Minute,
    5 * time.Minute, // max backoff
}

Then:

backoff := backoffs[min(attempt-1, len(backoffs)-1)]

For a short, fixed retry policy like this, I think the explicit table is easier to reason about than encoding the same behavior indirectly through arithmetic and a cap.

[openshift-ci]

@dcaravel: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/slim-e2e-tests	ffd9110	link	false	/test slim-e2e-tests
ci/prow/e2e-tests	ffd9110	link	false	/test e2e-tests

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.