Resolve rate limit threshold/interval from labkit registry

Max Woolfrequested to merge
rate-limit/registry-as-source-of-truth into master

What

Moves each rate limit's limit/period into the labkit SupportedRateLimits registry and resolves ApplicationRateLimiter.threshold/interval from it, behind the rate_limiter_resolve_limits_from_registry flag (default off). Implements gitlab-com/gl-infra/production-engineering#29054.

Why

Now that the labkit path is the only path (!239802 (merged)), the rate_limits hash and the registry each define every key. This makes the registry the single source of truth for limit/period. The flag is an instant revert net for the ~120-value migration: the rate_limits hash, the Increment* strategy classes, and threshold/interval stay until the flag is stable at 100%, then a follow-up removes them.

How

  • Registry entries (CE + EE) gained limit:/period:, transcribed from rate_limits using the same Gitlab::CurrentSettings.current_application_settings source.
  • threshold(key)/interval(key) resolve from the registry when the flag is on and from the legacy hash when off. build_rule is unchanged (it already calls them), so every call site and existing threshold/interval stub keeps working.
  • EE's rate_limits overrides two CE keys (code_suggestions_api_endpoint, geo_proxy); the EE registry deep-merges only their limit/period, keeping the CE structural fields.
  • A handful of specs that stubbed the rate_limits hash now stub the threshold method (the seam that survives the migration).
  • Removes the two orphaned code_suggestions_x_ray_* registry entries: their endpoints and rate_limits entries were deleted in !233939 (merged), the registry entries were left behind, and nothing resolves them.

Safety

The registry-coverage guard only checks key presence, not values. A new parity spec compares threshold/interval flag-on vs flag-off for every key and stubs application settings to per-name values, so a callable wired to the wrong sibling setting (e.g. users_api_limit_gpg_key vs _gpg_keys) is caught even when both share a default. Verified by injecting a mistype.

EE and FOSS suites pass for the touched specs; RuboCop clean.

Sequencing

Originally stacked on !239802 (merged), which has merged; this MR now targets master directly and the branch has been rebased so the diff contains only this MR's changes.

Feature flag

Flag Type Default
rate_limiter_resolve_limits_from_registry gitlab_com_derisk disabled

introduced_by_url is set; rollout_issue_url points to the rollout issue, #604856.

🤖beep boop

Edited by Max Woolf

Merge request reports