Close leaked response bodies

rpadmin/admin.go

@@ -519,6 +519,8 @@ func (a *AdminAPI) sendAll(rootCtx context.Context, method, path string, body, i
 				}
 			}
 		}
+
+		successfulResponseIndex int
 	)
 
 	for i, url := range a.urlsWithPath(path) {
@@ -536,7 +538,14 @@ func (a *AdminAPI) sendAll(rootCtx context.Context, method, path string, body, i
 			// Only one request should be successful, but for
 			// paranoia, we guard keeping the first successful
 			// response.
-			once.Do(func() { resURL, res = myURL, myRes })
+			once.Do(func() { resURL, res, successfulResponseIndex = myURL, myRes, except })
+
+			if except != successfulResponseIndex {
+				// close the response body for my response since it won't be read
+				// in the unmarshaling code
+				myRes.Body.Close()
+			}
+
 			return nil
 		})
 	}
@@ -650,6 +659,10 @@ func (a *AdminAPI) sendAndReceive(
 	}
 
 	if res.StatusCode/100 != 2 {
+		// we read the body just below, so this response is now
+		// junked and we need to close it.
+		defer res.Body.Close()
+
 		resBody, err := io.ReadAll(res.Body)
 		status := http.StatusText(res.StatusCode)
 		if err != nil {

rpadmin/api_debug.go

@@ -441,6 +441,7 @@ func (a *AdminAPI) DeleteDebugBundleFile(ctx context.Context, filename string) e
 }
 
 // DownloadDebugBundleFile gets the specific debug bundle file on the specified broker node.
+// The caller must call close on the response returned as it does not yet have its body read.
 func (a *AdminAPI) DownloadDebugBundleFile(ctx context.Context, filename string) (*http.Response, error) {
 	if len(a.urls) != 1 {
 		return nil, fmt.Errorf("unable to issue a single-admin-endpoint request to %d admin endpoints", len(a.urls))