[glance] Comprehensive v2 API rate limiting (fix action keys + watcher normalization) - #12540
Open
rajivmucheli wants to merge 2 commits into
Open
[glance] Comprehensive v2 API rate limiting (fix action keys + watcher normalization)#12540rajivmucheli wants to merge 2 commits into
rajivmucheli wants to merge 2 commits into
Conversation
rajivmucheli
requested review from
Scsabiii,
seb-kro and
stefanhipfel
as code owners
August 11, 2026 05:06
This commit extends the Glance rate limit configuration to cover all API v2 endpoints, providing better protection against API abuse. Changes: - Add global rate limits for tasks, schemas, and metadefs endpoints - Add local rate limits for: - Image file upload/download operations - Image stage and import workflow - Image actions (deactivate/reactivate) - Image members (sharing) - Image tags and locations - Tasks API (list, read, create, delete) - Schemas API (all schema endpoints) - Discovery/Info APIs (import, stores, usage) - Metadef namespaces, properties, objects, tags - Metadef resource types - Cache management endpoints - Multi-store operations Rate limit values: - Read operations: 300-600r/m per project - Write operations: 50-100r/m per project - Schemas (cacheable): 1000r/m per project - Global limits: 2000-5000r/m across all projects This ensures all Glance API endpoints are protected from excessive requests while maintaining reasonable limits for normal operations.
rajivmucheli
force-pushed
the
feature/glance-ratelimit-comprehensive
branch
from
August 11, 2026 05:12
07a5ebb to
8dd39c5
Compare
1. _watcher.yaml.tpl: add 'namespaces' to path_keywords so metadef namespace names are normalized to 'namespace' in the CADF URI instead of being treated as literal path segments (which caused no rate limit rule to ever match for metadef sub-resources) 2. _ratelimit.yaml.tpl: fix CADF action mismatches discovered via watcher middleware introspection: - schemas/*: add read/list (plural schema paths generate read/list) - info/stores: read -> read/list - metadefs/namespaces: read+list -> read/list (consolidated) - metadefs/namespaces/namespace/properties: add read/list - metadefs/namespaces/namespace/objects: add read/list - metadefs/namespaces/namespace/tags: read+list -> read/list - metadefs/resource_types: read+list -> read + read/list - metadefs/namespaces/namespace/resource_types: add read/list QA validation (monsoon3/cc-demo, production limits 300-1000r/m): 24/24 endpoints confirmed rate-limited. HTTP 429 (Too Many Requests) is returned by the middleware when a project exceeds its per-minute limit. Each test sent a parallel burst larger than the configured limit and counted the 429 responses. Format: "<429s received>/<total sent> (limit)". images_list 100/700 429s (600r/m) images_get 100/700 429s (600r/m) images_members_list 50/350 429s (300r/m) images_locations 49/350 429s (300r/m) images_file_head 398/700 429s (300r/m) tasks_list 50/350 429s (300r/m) schemas_image 98/1100 429s (1000r/m) schemas_images 100/1100 429s (1000r/m) schemas_member 100/1100 429s (1000r/m) schemas_members 99/1100 429s (1000r/m) schemas_task 100/1100 429s (1000r/m) schemas_tasks 100/1100 429s (1000r/m) schemas_metadef_ns 99/1100 429s (1000r/m) info_stores 49/350 429s (300r/m) info_import 50/350 429s (300r/m) info_usage 50/350 429s (300r/m) metadefs_namespaces 49/350 429s (300r/m) metadefs_namespace 50/350 429s (300r/m) metadefs_properties 50/350 429s (300r/m) metadefs_objects 48/350 429s (300r/m) metadefs_tags 50/350 429s (300r/m) metadefs_resource_types 50/350 429s (300r/m) metadefs_ns_resource_types 50/350 429s (300r/m) cache_list 250/350 429s (100r/m)
rajivmucheli
force-pushed
the
feature/glance-ratelimit-comprehensive
branch
from
August 11, 2026 05:14
8dd39c5 to
9f70dea
Compare
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
rate-limit-middlewareto all 24 Glance v2 API endpoints with per-project and global limitspath_keywords: addnamespacesso metadef namespace names are normalized tonamespacein the CADF URI (without this, sub-resource rules never matched)read/list, notread; corrected forinfo/stores,metadefs/namespaces,metadefs/*/tags, schemas, and resource_types endpointsValidation
Tested on QA using
monsoon3/cc-democredentials with production limits (300-1000r/m). HTTP 429 (Too Many Requests) is returned by the middleware when a project exceeds its per-minute limit. Each test sent a parallel burst larger than the configured limit and counted the 429 responses. Format:<429s received>/<total sent> (limit).24/24 PASS