Skip to content
GitLab
Next
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
  • Sign in / Register
  • scalability scalability
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
    • Locked Files
  • Issues 270
    • Issues 270
    • List
    • Boards
    • Service Desk
    • Milestones
    • Iterations
    • Requirements
  • Merge requests 1
    • Merge requests 1
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • Code review
    • Insights
    • Issue
    • Repository
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Commits
  • Issue Boards
Collapse sidebar
  • GitLab.comGitLab.com
  • GitLab Infrastructure TeamGitLab Infrastructure Team
  • scalabilityscalability
  • Issues
  • #629
Closed
Open
Issue created Oct 21, 2020 by Rachel Nienaber@rnienaberOwner

Create dry-run mode for Rack::Attack

Background

There is a risk that when Rate Limiting is enabled, we do not set the rates appropriately. If customers are negatively impacted, we could land up creating more incidents where users are reaching out for help with changing their limits.

When rate limiting was discussed previously, there was concern about how we can safely set limits and how we could know which customers would be impacted.

  • https://gitlab.com/gitlab-com/gl-infra/infrastructure/-/issues/9047#note_279892558
  • https://gitlab.com/gitlab-com/gl-infra/infrastructure/-/issues/9062#note_293970292

The intention would be to enable this for a short timeframe in order to make good choices about limits. Self-managed customers could also use this method to determine their own limits. While we would not change the UI to show this feature (that could be done in a separate iteration), we would need to document how to enable and disable it.

Proposal

  1. We allow a GITLAB_THROTTLE_DRY_RUN env var to be set. This is either:
    1. *, meaning all throttles.
    2. A comma-separated list of throttle names from https://gitlab.com/gitlab-org/gitlab/-/blob/master/config/initializers/rack_attack.rb: throttle_authenticated, throttle_authenticated_api, etc.
    3. #629 (comment 441729559) has some implementation notes.
  2. We ensure the dry-run status shows up in a useful way in the rack attack log config/initializers/rack_attack_logging.rb.
Edited Nov 05, 2020 by Sean McGivern
Assignee
Assign to
Time tracking