1d94e4d605
For registry operations, these were the numbers found at time the PR was written: download_blob 108 per second across fleet v2_auth 180 per second across fleet catalog 1 per second across fleet fetch_manifest 205 per second across fleet list_all_tags 150 per second across fleet With an average fleet size of 25. As a result, we went with a registry limit of 10r/s (10 * 25 = 250 requests) to bound even the most prolific puller. Fixes https://jira.coreos.com/browse/QUAY-976
16 lines
631 B
Nginx Configuration File
16 lines
631 B
Nginx Configuration File
# vim: ft=nginx
|
|
|
|
# Check the Authorization header and, if it is empty, use their proxy protocol
|
|
# IP, else use the header as their unique identifier for rate limiting.
|
|
map $http_authorization $registry_bucket {
|
|
"" $proxy_protocol_addr;
|
|
default $http_authorization;
|
|
}
|
|
|
|
limit_req_zone $proxy_protocol_addr zone=verbs:10m rate=1r/s;
|
|
limit_req_zone $registry_bucket zone=api:10m rate=1r/s;
|
|
limit_req_zone $registry_bucket zone=repositories:10m rate=1r/s;
|
|
limit_req_zone $registry_bucket zone=catalog:10m rate=20r/m;
|
|
limit_req_zone $registry_bucket zone=registry:10m rate=10r/s;
|
|
limit_req_status 429;
|
|
limit_req_log_level warn;
|