+1. There are a number of tricky things here to get to these simple goals, though, and since the sysctls affect all services, we have to have the TCP cases in mind as well:

1. We need to set the related ipvs conn_reuse sysctl to 2 before any of this. It's easy, it's an improvement today, and probably more of an improvement with everything else below.
2. Pybal + ipvsadm need fixups and/or deployed version updates as appropriate:
   1. Current jessie ipvsadm doesn't support weight=0
   2. Current jessie ipvsadm doesn't support setting the sh scheduler flag we need to make weight=0 work sanely
   3. Current PyBal doesn't support weight=0
3. Pybal needs to update its failure-monitoring depooling strategy before we turn on expire_nodest_conn - some of the monitors are too flappy, and flapping to a full backend-delete with expire_nodest_conn=1 has a lot more impact than without it. So before we turn on the sysctl, PyBal first has to get smarter about "weight=0 first, then remove later when failure persists".
4. Our maintenance tooling needs to get smarter about weight=0 periods as well, but turning on expire_nodest_conn before these are all fixed is ok. Since maintenance doesn't really flap pointlessly, and almost always the service ends up shutting off at least briefly and losing all TCP connections anyways, either setting of the sysctl without a weight=0 period has about the same effect.

The swap of Traffic for Traffic-Icebox in this ticket's set of tags was based on a bulk action for all such tickets that haven't been updated in 6 months or more. This does not imply any human judgement about the validity or importance of the task, and is simply the first step in a larger task cleanup effort. Further manual triage and/or requests for updates will happen this month for all such tickets. For more detail, have a look at the extended explanation on the main page of Traffic-Icebox . Thank you!