From 7880e9631f1c3ec0b9b5425088f9fcafd007b161 Mon Sep 17 00:00:00 2001
From: LeoZhangZXZ <xiaozhong.zhang@sap.com>
Date: Fri, 4 Sep 2026 09:17:11 +0200
Subject: [PATCH] update hermes rate limit config

---
 openstack/hermes/templates/etc/_hermes.conf.tpl |  8 ++++++++
 openstack/hermes/values.yaml                    | 12 ++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/openstack/hermes/templates/etc/_hermes.conf.tpl b/openstack/hermes/templates/etc/_hermes.conf.tpl
index 70883a8b668..a356b0accc3 100644
--- a/openstack/hermes/templates/etc/_hermes.conf.tpl
+++ b/openstack/hermes/templates/etc/_hermes.conf.tpl
@@ -15,3 +15,11 @@ password = "{{.Values.hermes.password | default "default"}}"
 user_domain_name = "Default"
 project_domain_name = "Default"
 project_name = "service"
+
+[API.RateLimit]
+RequestsPerSecond = {{.Values.hermes.rateLimit.requestsPerSecond | default 0}}
+Burst = {{.Values.hermes.rateLimit.burst | default 0}}
+DownloadRequestsPerSecond = {{.Values.hermes.rateLimit.downloadRequestsPerSecond | default 0}}
+DownloadBurst = {{.Values.hermes.rateLimit.downloadBurst | default 0}}
+EvictionInterval = "{{.Values.hermes.rateLimit.evictionInterval | default "5m"}}"
+MaxIdlePeriod = "{{.Values.hermes.rateLimit.maxIdlePeriod | default "10m"}}"
diff --git a/openstack/hermes/values.yaml b/openstack/hermes/values.yaml
index 6a9eaf332ee..9d975bf0af9 100644
--- a/openstack/hermes/values.yaml
+++ b/openstack/hermes/values.yaml
@@ -40,6 +40,18 @@ hermes:
     # hostnames are derived from this template using the key of the targets entry
     host_template: "%s-rabbitmq-notifications.monsoon3"
 
+  # Per-token rate limiting for the Hermes API.
+  # 0 (default) disables rate limiting. Enable per region as needed.
+  # Typical values: requestsPerSecond=2, burst=10 for the default endpoints;
+  # downloadRequestsPerSecond=0.2, downloadBurst=3 for the heavier /download endpoint.
+  rateLimit:
+    requestsPerSecond: 0
+    burst: 0
+    downloadRequestsPerSecond: 0
+    downloadBurst: 0
+    evictionInterval: "5m"
+    maxIdlePeriod: "10m"
+
   # Audit-event publisher for hermes-api PUT/DELETE dataplane-config operations.
   # Reuses the rabbitmq_notifications subchart; events land on the
   # notifications.info queue alongside other OpenStack control-plane audit events.