Skip to content

feat: Support runtime control of connection rate limiting via socket#930

Open
b1tamara wants to merge 4 commits into
cloudfoundry:masterfrom
sap-contributions:introduce-vars
Open

feat: Support runtime control of connection rate limiting via socket#930
b1tamara wants to merge 4 commits into
cloudfoundry:masterfrom
sap-contributions:introduce-vars

Conversation

@b1tamara

@b1tamara b1tamara commented Jun 1, 2026

Copy link
Copy Markdown
Contributor

The PR introduces process-level variables (for the properties block and connections) for the connection rate limit feature, enabling runtime control via the HAProxy Runtime API. It allows dynamic start/stop of rate limiting and on-the-fly threshold changes
Co-Authored-By: @Dariquest and @Mrizwanshaik

Co-authored-by: Alexander Nicke <alexander.nicke@sap.com>
Co-authored-by: Dariquest <daria.anton@sap.com>
Co-authored-by: M Rizwan Shaik <m.rizwan.shaik@sap.com>
@b1tamara b1tamara requested review from a team and CFN-CI as code owners June 1, 2026 10:15
@b1tamara b1tamara added the run-ci Allow this PR to be tested on Concourse label Jun 1, 2026
@b1tamara b1tamara removed the run-ci Allow this PR to be tested on Concourse label Jun 2, 2026
@b1tamara b1tamara added the run-ci Allow this PR to be tested on Concourse label Jun 2, 2026
Comment thread jobs/haproxy/templates/haproxy.config.erb Outdated
Comment thread docs/rate_limiting.md Outdated
Comment thread docs/rate_limiting.md

> Note: You will likely need `sudo` permission to run socat.

## Control Connection Rate Limiting via HAProxy Runtime API

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe make the two new proc. variables more prominent, by introducing them in an unsorted list, similar to the variables and options listed in the section "Configuration Options". It was first a bit hard for me to understand why we have these proc variables now.

One point about the naming:
connections_rate_limit.block -> proc.conn_rate_block
connections_rate_limit.connections -> proc.conn_rate_limit

Is inconsistent. If we could still change the it and accept it's breaking, I'd prefer the following variable naming:

connection_rate_limit.enabled -> proc.connection_rate_limit_enabled
connection_rate_limit.connections -> proc.connection_rate_limit_connections

This would be more consistent, and having enabled instead of block indicates that this is a boolean switch.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Renamed variables:
connection_rate_limit.block -> proc.connection_rate_limit_block
connection_rate_limit.connections -> proc.connection_rate_limit_connections

Enhanced the documentation

Comment on lines +337 to +339
<%- if_p("ha_proxy.connections_rate_limit.connections") do |conn_rate_connections| -%>
set-var proc.conn_rate_limit int(<%= conn_rate_connections %>)
<%- end -%>

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did I understand correctly that the existence of connections_rate_limit.connections in manifest controls if haproxy config will have a process variable, and when it is not set in manifest, the rate-limit control is not possible on the fly? If so, it does not look straightforward to me.
Can we set the variable to zero if the parameter is not set in the manifest? Similar to what we do for proc.conn_rate_block.

Suggested change
<%- if_p("ha_proxy.connections_rate_limit.connections") do |conn_rate_connections| -%>
set-var proc.conn_rate_limit int(<%= conn_rate_connections %>)
<%- end -%>
set-var proc.conn_rate_limit int(<%= p("ha_proxy.connections_rate_limit.connections", 0) %>)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We store the value from the manifest in a process-level variable if defined. If not, it can be set via the socket later. We cannot set the default value to 0, as 0 is a very wrong threshold.

b1tamara and others added 2 commits June 11, 2026 11:37
Co-authored-by: Clemens Hoffmann <clemens.hoffmann@sap.com>
@b1tamara b1tamara requested a review from hoffmaen June 11, 2026 10:34
@github-project-automation github-project-automation Bot moved this from Inbox to Pending Merge | Prioritized in Application Runtime Platform Working Group Jun 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

run-ci Allow this PR to be tested on Concourse

Projects

Status: Pending Merge | Prioritized

Development

Successfully merging this pull request may close these issues.

3 participants