From 981e3cde0e51bb40ad68055c406eccf0a87cb0bd Mon Sep 17 00:00:00 2001
From: George Hicken <ghicken@vmware.com>
Date: Wed, 16 Nov 2022 10:38:29 -0800
Subject: [PATCH 1/4] Fix missing timeout arg in helpers and filter in lint

---
 Makefile                      | 2 +-
 infra/scripts/bash-helpers.sh | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/Makefile b/Makefile
index e6bbd42b06e..4999ee56399 100644
--- a/Makefile
+++ b/Makefile
@@ -212,7 +212,7 @@ whitespace:
 	@infra/scripts/whitespace-check.sh
 
 # exit 1 if golint complains about anything other than comments
-golintf = $(GOLINT) $(1) | sh -c "! grep -v 'lib/apiservers/portlayer/restapi/operations'" | sh -c "! grep -v 'lib/config/dynamic/admiral/client'" | sh -c "! grep -v 'should have comment'" | sh -c "! grep -v 'comment on exported'" | sh -c "! grep -v 'by other packages, and that stutters'" | sh -c "! grep -v 'error strings should not be capitalized'"
+golintf = $(GOLINT) $(1) | sh -c "! grep -v 'lib/apiservers/portlayer/restapi/operations'" | sh -c "! grep -v 'lib/apiservers/service/restapi/operations/not_yet_implemented'" | sh -c "! grep -v 'lib/config/dynamic/admiral/client'" | sh -c "! grep -v 'should have comment'" | sh -c "! grep -v 'comment on exported'" | sh -c "! grep -v 'by other packages, and that stutters'" | sh -c "! grep -v 'error strings should not be capitalized'"
 
 golint: $(GOLINT)
 	@echo checking go lint...
diff --git a/infra/scripts/bash-helpers.sh b/infra/scripts/bash-helpers.sh
index c3f86fdf6df..25c629b203d 100644
--- a/infra/scripts/bash-helpers.sh
+++ b/infra/scripts/bash-helpers.sh
@@ -30,7 +30,7 @@ fi
 # 1: release numnber, e.g. 1.4.1 or 1.4.1-rc2, or build id, e.g. 19653
 vic-set-version () {
     version="$1"
-    
+
     if [ "$1" == "" ]; then
         unset VIC_VERSION
         return
@@ -63,7 +63,7 @@ init-profile () {
 
 unset-vic () {
     unset TARGET_URL MAPPED_NETWORKS NETWORKS IMAGE_STORE DATASTORE COMPUTE VOLUME_STORES IPADDR TLS THUMBPRINT OPS_CREDS VIC_NAME PRESERVE_VOLUMES
-    unset GOVC_URL GOVC_INSECURE GOVC_DATACENTER GOVC_USERNAME GOVC_PASSWORD GOVC_DATASTORE GOVC_CERTIFICATE 
+    unset GOVC_URL GOVC_INSECURE GOVC_DATACENTER GOVC_USERNAME GOVC_PASSWORD GOVC_DATASTORE GOVC_CERTIFICATE
 
     unset vsphere datacenter user password opsuser opspass opsgrant timeout compute datastore dns publicNet publicIP publicGW bridgeNet bridgeRange
     unset clientNet clientIP clientGW managementNet managementIP managementGW tls volumestores preserveVolumestores containernet
@@ -79,7 +79,7 @@ vic-create () {
     base=$(pwd)
     (
         cd "$(vic-path)"/bin || return
-        "$(vic-path)/bin/${VIC_VERSION}/vic-machine-$OS" create --target="$TARGET_URL" "${OPS_CREDS[@]}" --image-store="$IMAGE_STORE" --compute-resource="$COMPUTE" "${TLS[@]}" ${TLS_OPTS} --name="${VIC_NAME:-${USER}test}" "${MAPPED_NETWORKS[@]}" "${VOLUME_STORES[@]}" "${NETWORKS[@]}" ${IPADDR} ${TIMEOUT} --thumbprint="$THUMBPRINT" --ai="${VIC_VERSION}/appliance.iso" --bi="${VIC_VERSION}/bootstrap.iso" "$@"
+        "$(vic-path)/bin/${VIC_VERSION}/vic-machine-$OS" create --target="$TARGET_URL" "${OPS_CREDS[@]}" --image-store="$IMAGE_STORE" --compute-resource="$COMPUTE" "${TLS[@]}" ${TLS_OPTS} --name="${VIC_NAME:-${USER}test}" "${MAPPED_NETWORKS[@]}" "${VOLUME_STORES[@]}" "${NETWORKS[@]}" ${IPADDR} --timeout=${TIMEOUT} --thumbprint="$THUMBPRINT" --ai="${VIC_VERSION}/appliance.iso" --bi="${VIC_VERSION}/bootstrap.iso" "$@"
     )
 
     vic-select

From df1b4602bf51e74fccb4b742d4f2004a7dfbdfdc Mon Sep 17 00:00:00 2001
From: George Hicken <ghicken@vmware.com>
Date: Thu, 1 Dec 2022 14:32:37 -0800
Subject: [PATCH 2/4] Expose max concurrent connection config option

This adds an option to set the maximum number of concurrent connections
to vCenter that will be used by the port layer.
This does NOT effect the admin server, and admin server connections do
not count towards the maximum for the port layer.

This adds a --max-concurrent-connections (--mcc short form) option to
create and configure, allowing setting between 2 (because port layer
requires 2 minimum to initialize) and 255 (because it's a sane upper
limit, given default has been 32 since 2017, but with no reason beyond
that).

This has NOT made the necessary changes for this option to be available
via the VIC LCM API and vCenter UI extension.

Testing so far has been via manual use of CLI.
---
 cmd/vic-machine/common/target.go         |  11 +++
 cmd/vic-machine/common/target_test.go    |   6 +-
 cmd/vic-machine/configure/configure.go   |   6 ++
 cmd/vic-machine/create/create.go         |   2 +
 cmd/vic-machine/create/create_test.go    |   2 +-
 lib/config/executor/container_vm.go      |  37 +++++++-
 lib/config/executor/container_vm_test.go | 113 +++++++++++++++++++++++
 lib/config/virtual_container_host.go     |  25 ++---
 lib/constants/constants.go               |   9 ++
 lib/install/data/data.go                 |   4 +
 lib/install/management/appliance.go      |   5 +
 lib/install/validate/config_to_data.go   |  11 +++
 lib/install/validate/validator.go        |  25 ++++-
 pkg/vsphere/session/session.go           |   8 +-
 14 files changed, 244 insertions(+), 20 deletions(-)
 create mode 100644 lib/config/executor/container_vm_test.go

diff --git a/cmd/vic-machine/common/target.go b/cmd/vic-machine/common/target.go
index e96e5e5fe55..c4cbf5c7173 100644
--- a/cmd/vic-machine/common/target.go
+++ b/cmd/vic-machine/common/target.go
@@ -33,6 +33,8 @@ type Target struct {
 	Password    *string
 	CloneTicket string
 	Thumbprint  string `cmd:"thumbprint"`
+
+	MaxConcurrentConnections *int `cmd:"max-concurrent-connections"`
 }
 
 func NewTarget() *Target {
@@ -67,11 +69,20 @@ func (t *Target) TargetFlags() []cli.Flag {
 			Usage:       "ESX or vCenter host certificate thumbprint",
 			EnvVar:      "VIC_MACHINE_THUMBPRINT",
 		},
+		cli.GenericFlag{
+			Name:   "max-concurrent-connections, mcc",
+			Value:  flags.NewOptionalInt(&t.MaxConcurrentConnections),
+			Usage:  "Determines maximum number of connections (not sessions) to vCenter. Integer value, greater than 0",
+			EnvVar: "VIC_MACHINE_MAX_CONCURRENT_CONNECTIONS",
+			Hidden: true,
+		},
 	}
 }
 
 // HasCredentials check that the credentials have been supplied by any of the permitted mechanisms
 func (t *Target) HasCredentials(op trace.Operation) error {
+	defer trace.End(trace.Begin("", op))
+
 	if t.URL == nil {
 		return cli.NewExitError("--target argument must be specified", 1)
 	}
diff --git a/cmd/vic-machine/common/target_test.go b/cmd/vic-machine/common/target_test.go
index 58f83b6338d..e4fe99b462b 100644
--- a/cmd/vic-machine/common/target_test.go
+++ b/cmd/vic-machine/common/target_test.go
@@ -29,7 +29,7 @@ func TestFlags(t *testing.T) {
 	target := NewTarget()
 	flags := target.TargetFlags()
 
-	if len(flags) != 4 {
+	if len(flags) != 5 {
 		t.Errorf("Wrong flag numbers")
 	}
 }
@@ -50,6 +50,10 @@ func TestProcess(t *testing.T) {
 		User     string
 		Password *string
 
+		// MaxConcurrentConnections is not tested here as there's no explicit validation at this stage
+		// Validation of input type is via flags package, and validation of values is via validator
+		/// mcc *int
+
 		err    error
 		result *url.URL
 	}{
diff --git a/cmd/vic-machine/configure/configure.go b/cmd/vic-machine/configure/configure.go
index 23f55ada2cb..18b73bc07a9 100644
--- a/cmd/vic-machine/configure/configure.go
+++ b/cmd/vic-machine/configure/configure.go
@@ -19,6 +19,7 @@ import (
 	"fmt"
 	"net"
 	"os"
+	"strconv"
 	"strings"
 	"time"
 
@@ -214,6 +215,11 @@ func (c *Configure) copyChangedConf(o *config.VirtualContainerHostConfigSpec, n
 		updateSessionEnv(portlayerSession, config.PortLayerDCPath, v.Session().Datacenter.Name())
 	}
 
+	// if mcc is explicitly set, apply it
+	if c.Data.MaxConcurrentConnections != nil {
+		updateSessionEnv(portlayerSession, config.PortLayerMaxConcurrentConnections, strconv.Itoa(*c.Data.MaxConcurrentConnections))
+	}
+
 	if c.Debug.Debug != nil {
 		o.SetDebug(n.Diagnostics.DebugLevel)
 	}
diff --git a/cmd/vic-machine/create/create.go b/cmd/vic-machine/create/create.go
index 03915f49689..df9e986fa70 100644
--- a/cmd/vic-machine/create/create.go
+++ b/cmd/vic-machine/create/create.go
@@ -719,6 +719,8 @@ func (c *Create) Run(clic *cli.Context) (err error) {
 
 	vConfig.Timeout = c.Data.Timeout
 
+	vConfig.MaxConcurrentConnections = c.MaxConcurrentConnections
+
 	// separate initial validation from dispatch of creation task
 	op.Info("")
 
diff --git a/cmd/vic-machine/create/create_test.go b/cmd/vic-machine/create/create_test.go
index e257db88ad5..91c93b454a9 100644
--- a/cmd/vic-machine/create/create_test.go
+++ b/cmd/vic-machine/create/create_test.go
@@ -72,7 +72,7 @@ func TestParseGatewaySpec(t *testing.T) {
 func TestFlags(t *testing.T) {
 	c := NewCreate()
 	flags := c.Flags()
-	numberOfFlags := 65
+	numberOfFlags := 66
 	assert.Equal(t, numberOfFlags, len(flags), "Missing flags during Create.")
 }
 
diff --git a/lib/config/executor/container_vm.go b/lib/config/executor/container_vm.go
index b616e08e66c..b9ed6ec6c52 100644
--- a/lib/config/executor/container_vm.go
+++ b/lib/config/executor/container_vm.go
@@ -119,7 +119,8 @@ type ExitLog struct {
 // MountSpec details a mount that must be executed within the executor
 // A mount is a URI -> path mapping with a credential of some kind
 // In the case of a labeled disk:
-// 	label://<label name> => </mnt/path>
+//
+//	label://<label name> => </mnt/path>
 type MountSpec struct {
 	// A URI->path mapping, e.g.
 	// May contain credentials
@@ -283,6 +284,40 @@ type SessionConfig struct {
 	Detail `vic:"0.1" scope:"read-write" key:"detail"`
 }
 
+// GetEnv returns
+// * the value of the specified environment variable if present
+// * nil if not present
+func (sc *SessionConfig) GetEnv(name string) *string {
+	if sc == nil {
+		return nil
+	}
+
+	for _, env := range sc.Cmd.Env {
+		if strings.HasPrefix(env, name+"=") {
+			val := strings.TrimPrefix(env, name+"=")
+			return &val
+		}
+	}
+
+	return nil
+}
+
+// SetEnv sets the value of the specified environment variable, returning:
+// * the old value if present
+// * nil if not present
+func (sc *SessionConfig) SetEnv(name, value string) *string {
+	for i, env := range sc.Cmd.Env {
+		if strings.HasPrefix(env, name+"=") {
+			sc.Cmd.Env[i] = name + "=" + value
+			val := strings.TrimPrefix(env, name+"=")
+			return &val
+		}
+	}
+
+	sc.Cmd.Env = append(sc.Cmd.Env, name+"="+value)
+	return nil
+}
+
 type Detail struct {
 
 	// creation, started & stopped timestamps
diff --git a/lib/config/executor/container_vm_test.go b/lib/config/executor/container_vm_test.go
new file mode 100644
index 00000000000..1927eec68e2
--- /dev/null
+++ b/lib/config/executor/container_vm_test.go
@@ -0,0 +1,113 @@
+// Copyright 2016-2018 VMware, Inc. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//    http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package executor
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetEnv(t *testing.T) {
+	sess := SessionConfig{
+		Cmd: Cmd{
+			Env: []string{
+				"hello=world",
+				"goodbye=",
+			},
+		},
+	}
+
+	assert.Equal(t, "world", *sess.GetEnv("hello"), "Get on set variable should return set value")
+	assert.Equal(t, "", *sess.GetEnv("goodbye"), "Get on set variable with empty value should return empty string")
+	assert.Nil(t, sess.GetEnv("nope"), "Get on an unset variable should return nil")
+}
+
+func TestSetEnvUpdateValue(t *testing.T) {
+	sess := SessionConfig{
+		Cmd: Cmd{
+			Env: []string{
+				"hello=world",
+				"goodbye=",
+			},
+		},
+	}
+
+	require.Equal(t, "world", *sess.GetEnv("hello"), "Get on set variable should return set value")
+	require.Equal(t, "", *sess.GetEnv("goodbye"), "Get on set variable with empty value should return empty string")
+
+	newVal := "sapients"
+	old := *sess.SetEnv("hello", newVal)
+
+	assert.Equal(t, "world", old, "Expected old value to be return on update")
+	assert.Equal(t, newVal, *sess.GetEnv("hello"), "Expected new value to be updated value")
+
+	assert.Equal(t, "", *sess.GetEnv("goodbye"), "Expected unmodified value not to have changed")
+}
+
+func TestSetEnvEmptyValue(t *testing.T) {
+	sess := SessionConfig{
+		Cmd: Cmd{
+			Env: []string{
+				"hello=world",
+				"goodbye=",
+			},
+		},
+	}
+
+	require.Equal(t, "world", *sess.GetEnv("hello"), "Get on set variable should return set value")
+	require.Equal(t, "", *sess.GetEnv("goodbye"), "Get on set variable with empty value should return empty string")
+
+	newVal := "sapients"
+	old := *sess.SetEnv("goodbye", newVal)
+
+	assert.Equal(t, "", old, "Expected old value to be return on update")
+	assert.Equal(t, newVal, *sess.GetEnv("goodbye"), "Expected new value to be updated value")
+
+	assert.Equal(t, "world", *sess.GetEnv("hello"), "Expected unmodified value not to have changed")
+}
+
+func TestSetEnvNewEnv(t *testing.T) {
+	sess := SessionConfig{
+		Cmd: Cmd{
+			Env: []string{
+				"hello=world",
+				"goodbye=",
+			},
+		},
+	}
+
+	require.Equal(t, "world", *sess.GetEnv("hello"), "Get on set variable should return set value")
+	require.Equal(t, "", *sess.GetEnv("goodbye"), "Get on set variable with empty value should return empty string")
+
+	newKey := "solo"
+	require.Nil(t, sess.GetEnv(newKey), "Expected nil return for unset value")
+
+	// checking we can set a new env with value of empty string
+	newVal := ""
+	_ = sess.SetEnv(newKey, newVal)
+	assert.Equal(t, newVal, *sess.GetEnv(newKey), "Expected new value to be updated value")
+
+	// checking we can set a new env with value specified
+	newKey = "absence"
+	newVal = "fonder"
+
+	_ = sess.SetEnv(newKey, newVal)
+	assert.Equal(t, newVal, *sess.GetEnv(newKey), "Expected new value to be updated value")
+
+	assert.Equal(t, "world", *sess.GetEnv("hello"), "Expected unmodified value not to have changed")
+	assert.Equal(t, "", *sess.GetEnv("goodbye"), "Expected unmodified value not to have changed")
+}
diff --git a/lib/config/virtual_container_host.go b/lib/config/virtual_container_host.go
index 3933ba5446d..5eec3484418 100644
--- a/lib/config/virtual_container_host.go
+++ b/lib/config/virtual_container_host.go
@@ -54,18 +54,19 @@ const (
 	PortLayerService = "port-layer"
 	VicAdminService  = "vicadmin"
 
-	GeneralHTTPProxy   = "HTTP_PROXY"
-	GeneralHTTPSProxy  = "HTTPS_PROXY"
-	GeneralNoProxy     = "NO_PROXY"
-	VICAdminHTTPProxy  = "VICADMIN_HTTP_PROXY"
-	VICAdminHTTPSProxy = "VICADMIN_HTTPS_PROXY"
-	VICAdminNoProxy    = "NO_PROXY"
-	VICAdminCSPath     = "--cluster"
-	VICAdminPoolPath   = "--pool"
-	VICAdminDCPath     = "--dc"
-	PortLayerCSPath    = "CS_PATH"
-	PortLayerPoolPath  = "POOL_PATH"
-	PortLayerDCPath    = "DC_PATH"
+	GeneralHTTPProxy                  = "HTTP_PROXY"
+	GeneralHTTPSProxy                 = "HTTPS_PROXY"
+	GeneralNoProxy                    = "NO_PROXY"
+	VICAdminHTTPProxy                 = "VICADMIN_HTTP_PROXY"
+	VICAdminHTTPSProxy                = "VICADMIN_HTTPS_PROXY"
+	VICAdminNoProxy                   = "NO_PROXY"
+	VICAdminCSPath                    = "--cluster"
+	VICAdminPoolPath                  = "--pool"
+	VICAdminDCPath                    = "--dc"
+	PortLayerCSPath                   = "CS_PATH"
+	PortLayerPoolPath                 = "POOL_PATH"
+	PortLayerDCPath                   = "DC_PATH"
+	PortLayerMaxConcurrentConnections = "VIC_MAX_IN_FLIGHT"
 
 	AddPerms = "ADD"
 )
diff --git a/lib/constants/constants.go b/lib/constants/constants.go
index b050342f856..d95dc4fb17d 100644
--- a/lib/constants/constants.go
+++ b/lib/constants/constants.go
@@ -84,6 +84,15 @@ const (
 	TaskCreatedState = "created"
 	TaskFailedState  = "failed"
 	TaskUnknownState = "unknown"
+
+	// DefaultMaxConcurrentRequests limits the maximum number of SOAP operations in flight
+	// This has the effect of modifying the MaxIdleConnsPerHost field of the soap transport
+	DefaultMaxConcurrentRequests = 32
+	// MaximumMaxConcurrentRequests limits the upper bound that can be specified for concurrent connections
+	MaximumMaxConcurrentRequests = 255
+	// MinMaxConcurrentRequests is necessary because testing shows the port layer doesn't fully initialize if
+	// lower than this
+	MinMaxConcurrentRequests = 2
 )
 
 func DefaultAltVCHGuestName() string {
diff --git a/lib/install/data/data.go b/lib/install/data/data.go
index 57670a8062a..d3ecaa18cb3 100644
--- a/lib/install/data/data.go
+++ b/lib/install/data/data.go
@@ -127,6 +127,8 @@ type InstallerData struct {
 	ResourcePoolPath       string
 	ApplianceInventoryPath string
 
+	MaxConcurrentConnections *int
+
 	Datacenter types.ManagedObjectReference
 	Cluster    types.ManagedObjectReference
 
@@ -377,5 +379,7 @@ func (d *Data) CopyNonEmpty(src *Data) error {
 
 	d.ContainerConfig.ContainerNameConvention = src.ContainerConfig.ContainerNameConvention
 
+	d.MaxConcurrentConnections = src.MaxConcurrentConnections
+
 	return nil
 }
diff --git a/lib/install/management/appliance.go b/lib/install/management/appliance.go
index bec409b888f..57230881bfb 100644
--- a/lib/install/management/appliance.go
+++ b/lib/install/management/appliance.go
@@ -693,6 +693,11 @@ func (d *Dispatcher) createAppliance(conf *config.VirtualContainerHostConfigSpec
 		Active:  true,
 	}
 
+	if settings.MaxConcurrentConnections != nil {
+		d.op.Debugf("Setting max concurrent connections in portlayer environment to %d", *settings.MaxConcurrentConnections)
+		cfg.Cmd.Env = append(cfg.Cmd.Env, fmt.Sprintf("%s=%s", config.PortLayerMaxConcurrentConnections, strconv.Itoa(*settings.MaxConcurrentConnections)))
+	}
+
 	conf.AddComponent(config.PortLayerService, cfg)
 
 	// fix up those parts of the config that depend on the final applianceVM folder name
diff --git a/lib/install/validate/config_to_data.go b/lib/install/validate/config_to_data.go
index 814faa64689..35fa6e38f20 100644
--- a/lib/install/validate/config_to_data.go
+++ b/lib/install/validate/config_to_data.go
@@ -19,6 +19,7 @@ import (
 	"fmt"
 	"net/url"
 	"path"
+	"strconv"
 	"strings"
 
 	"github.com/docker/go-units"
@@ -162,6 +163,16 @@ func NewDataFromConfig(ctx context.Context, finder Finder, conf *config.VirtualC
 	d.OpsCredentials.OpsPassword = &conf.Connection.Token
 	d.Thumbprint = conf.Connection.TargetThumbprint
 
+	maxConcurrent := conf.ExecutorConfig.Sessions[config.PortLayerService].GetEnv(config.PortLayerMaxConcurrentConnections)
+	if maxConcurrent != nil {
+		var max int
+		max, err = strconv.Atoi(*maxConcurrent)
+		if err != nil {
+			return
+		}
+		d.MaxConcurrentConnections = &max
+	}
+
 	d.AsymmetricRouting = conf.AsymmetricRouting
 
 	if err = setBridgeNetwork(op, finder, d, conf); err != nil {
diff --git a/lib/install/validate/validator.go b/lib/install/validate/validator.go
index 7d56006fb3c..ec8babdb93e 100644
--- a/lib/install/validate/validator.go
+++ b/lib/install/validate/validator.go
@@ -490,22 +490,25 @@ func (v *Validator) sessionValid(op trace.Operation, errMsg string) bool {
 		v.NoteIssue(errors.New(errMsg))
 		return false
 	}
+
 	return true
 }
 
 func (v *Validator) target(op trace.Operation, input *data.Data, conf *config.VirtualContainerHostConfigSpec) {
 	defer trace.End(trace.Begin("", op))
 
-	// check if host is managed by VC
 	v.managedbyVC(op)
+	v.connectionManagement(op, input, conf)
 }
 
+// managedbyVC checks if host is managed by VC and is blocked from direct interaction
 func (v *Validator) managedbyVC(op trace.Operation) {
 	defer trace.End(trace.Begin("", op))
 
 	if v.isVC() {
 		return
 	}
+
 	host, err := v.session.Finder.DefaultHostSystem(op)
 	if err != nil {
 		v.NoteIssue(fmt.Errorf("Failed to get host system: %s", err))
@@ -522,6 +525,26 @@ func (v *Validator) managedbyVC(op trace.Operation) {
 	if ip := mh.Summary.ManagementServerIp; ip != "" {
 		v.NoteIssue(fmt.Errorf("Target is managed by vCenter server %q, please change --target to vCenter server address or select a standalone ESXi", ip))
 	}
+
+	return
+}
+
+func (v *Validator) connectionManagement(op trace.Operation, input *data.Data, conf *config.VirtualContainerHostConfigSpec) {
+	defer trace.End(trace.Begin("", op))
+
+	if input.MaxConcurrentConnections == nil {
+		return
+	}
+
+	// unsure if we need to set a maximum bound as well. Adding something sane, but above the
+	// default that's been in force since 2017
+	if *input.MaxConcurrentConnections < constants.MinMaxConcurrentRequests || *input.MaxConcurrentConnections > constants.MaximumMaxConcurrentRequests {
+		op.Debugf("Validating max connection failed")
+
+		v.NoteIssue(fmt.Errorf("Maximum concurrent connections must be between %d - %d inclusive", constants.MinMaxConcurrentRequests, constants.MaximumMaxConcurrentRequests))
+		return
+	}
+
 	return
 }
 
diff --git a/pkg/vsphere/session/session.go b/pkg/vsphere/session/session.go
index 9f3107f7597..e4cfe2f4a42 100644
--- a/pkg/vsphere/session/session.go
+++ b/pkg/vsphere/session/session.go
@@ -21,7 +21,6 @@
 // each corresponding value in Config. The Session is returned and
 // the user can use the cached govmomi objects in the exported fields of
 // Session instead of directly using a govmomi Client.
-//
 package session
 
 import (
@@ -45,13 +44,13 @@ import (
 	"github.com/vmware/govmomi/vim25/soap"
 	"github.com/vmware/govmomi/vim25/types"
 	"github.com/vmware/vic/lib/config"
+	"github.com/vmware/vic/lib/constants"
 	"github.com/vmware/vic/pkg/errors"
 	"github.com/vmware/vic/pkg/trace"
 	"github.com/vmware/vic/pkg/vsphere/extraconfig"
 )
 
 const (
-	defaultMaxInFlight  = 32
 	tlsHandshakeTimeout = 30 * time.Second
 )
 
@@ -69,6 +68,7 @@ type Config struct {
 	Thumbprint string
 	// Keep alive duration
 	Keepalive time.Duration
+	// Maximum
 	// User-Agent to identify login sessions (see: govc session.ls)
 	UserAgent string
 
@@ -232,9 +232,9 @@ func (s *Session) Connect(ctx context.Context) (*Session, error) {
 
 	soapClient.SetThumbprint(soapURL.Host, s.Thumbprint)
 
-	maxInFlight := defaultMaxInFlight
+	maxInFlight := constants.DefaultMaxConcurrentRequests
 	if e := os.Getenv("VIC_MAX_IN_FLIGHT"); e != "" {
-		if i, err := strconv.Atoi(e); err == nil {
+		if i, err := strconv.Atoi(e); err == nil && i > 0 {
 			maxInFlight = i
 		}
 	}

From ed84e19d3c5d53ca0ceaa1b097813c0ab9185c4e Mon Sep 17 00:00:00 2001
From: hickeng <ghicken@vmware.com>
Date: Fri, 2 Dec 2022 21:45:34 -0800
Subject: [PATCH 3/4] Revise check org membership

Prior test was unnecessarily complex and resulting in
a non-useful message in error case

The automation token can be added into drone using the drone cli:
* drone secret add
or
* login to the drone webui, go to profile->secrets, and update via
the box in the top right

https://ci-vic.vmware.com/vmware/vic/settings/secrets at time of
writing
---
 tests/check-org-membership.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tests/check-org-membership.sh b/tests/check-org-membership.sh
index a948d6ec143..fda7c9e508c 100755
--- a/tests/check-org-membership.sh
+++ b/tests/check-org-membership.sh
@@ -24,7 +24,11 @@ if [ "$SKIP_CHECK_MEMBERSHIP" == "true" ]; then
   exit 0
 fi
 
-if [ ! $(curl --silent -H "Authorization: token $GITHUB_AUTOMATION_API_KEY" "https://api.github.com/orgs/vmware/members/${DRONE_COMMIT_AUTHOR}") ]; then
+# assuming that the logic here is both a successful curl AND no output.
+# testing with a bad auth token shows a 0 return code for curl, but json blob with error
+# good auth token is just empty response
+result=$(curl --silent -H "Authorization: token $GITHUB_AUTOMATION_API_KEY" "https://api.github.com/orgs/vmware/members/${DRONE_COMMIT_AUTHOR}")
+if [ "$?" -eq 0 -o -n "$result" ]; then
   echo "checked origin membership successfully"
 else
   echo "failed to check origin membership"

From 878f91cf90002fabb28bf147848a58b870af1b1e Mon Sep 17 00:00:00 2001
From: hickeng <ghicken@vmware.com>
Date: Mon, 5 Dec 2022 17:06:56 -0800
Subject: [PATCH 4/4] Fix focused-test target for https based clone

---
 infra/scripts/focused-test.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/infra/scripts/focused-test.sh b/infra/scripts/focused-test.sh
index 8b06879e783..de80e23fcb3 100755
--- a/infra/scripts/focused-test.sh
+++ b/infra/scripts/focused-test.sh
@@ -20,7 +20,7 @@
 #
 
 if [ -z "$1" ]; then
-    export REMOTE=$(git remote -v | grep "github.com.vmware/vic.git (fetch)" | awk '{print$1;exit}')/master
+    export REMOTE=$(git remote -v | grep "github.com.vmware/vic\(\.git\)* (fetch)" | awk '{print$1;exit}')/master
     echo "Using ${REMOTE} as default remote"
 else
     echo "Using ${REMOTE} as specified remote"