quay/conf/nginx/rate-limiting.conf

# vim: ft=nginx

# Check the Authorization header and, if it is empty, use their proxy protocol
# IP, else use the header as their unique identifier for rate limiting.
map $http_authorization $registry_bucket {
  ""      $proxy_protocol_addr;
  default $http_authorization;
}

limit_req_zone $proxy_protocol_addr zone=verbs:10m rate=1r/s;
limit_req_zone $registry_bucket zone=api:10m rate=25r/s;
limit_req_zone $registry_bucket zone=repositories:10m rate=1r/s;
limit_req_zone $registry_bucket zone=catalog:10m rate=20r/m;
limit_req_zone $registry_bucket zone=registry:10m rate=20r/s;
limit_req_status 429;
limit_req_log_level warn;
Add rate limiting to nginx. The only caveat is that "One megabyte zone can keep about 16 thousand 64-byte states. If the zone storage is exhausted, the server will return the 503 (Service Temporarily Unavailable) error to all further requests." -- nginx documentation 2015-01-13 20:59:04 +00:00			`# vim: ft=nginx`

nginx: make rate limiting awesome 2015-02-19 21:24:05 +00:00			`# Check the Authorization header and, if it is empty, use their proxy protocol`
			`# IP, else use the header as their unique identifier for rate limiting.`
			`map $http_authorization $registry_bucket {`
			`"" $proxy_protocol_addr;`
			`default $http_authorization;`
			`}`

nginx: rate limit 1r/s This reduces our rate limiting down to to 1 request per second. 2017-12-12 21:39:45 +00:00			`limit_req_zone $proxy_protocol_addr zone=verbs:10m rate=1r/s;`
Increase the rate limit on the API 2018-07-18 19:44:20 +00:00			`limit_req_zone $registry_bucket zone=api:10m rate=25r/s;`
nginx: rate limit 1r/s This reduces our rate limiting down to to 1 request per second. 2017-12-12 21:39:45 +00:00			`limit_req_zone $registry_bucket zone=repositories:10m rate=1r/s;`
Audit out endpoints and ensure everything has a defined rate limit (even if quite large) For registry operations, these were the numbers found at time the PR was written: download_blob 108 per second across fleet v2_auth 180 per second across fleet catalog 1 per second across fleet fetch_manifest 205 per second across fleet list_all_tags 150 per second across fleet With an average fleet size of 25. As a result, we went with a registry limit of 10r/s (10 * 25 = 250 requests) to bound even the most prolific puller. Fixes https://jira.coreos.com/browse/QUAY-976 2018-06-18 18:40:09 +00:00			`limit_req_zone $registry_bucket zone=catalog:10m rate=20r/m;`
Temporarily double the request limit. We'll start ratcheting it down over time. 2018-06-20 18:31:51 +00:00			`limit_req_zone $registry_bucket zone=registry:10m rate=20r/s;`
Add rate limiting to nginx. The only caveat is that "One megabyte zone can keep about 16 thousand 64-byte states. If the zone storage is exhausted, the server will return the 503 (Service Temporarily Unavailable) error to all further requests." -- nginx documentation 2015-01-13 20:59:04 +00:00			`limit_req_status 429;`
			`limit_req_log_level warn;`