2ec6709eee
This patch adds rate limiting for any API call which results in a 4xx response by applying a common stick-table to each HAProxy backend definition. The stick table can be overridden to allow customisation of the behaviour. An additional stick-table is defined for the Horizon endpoint to enforce a 20-requests-per-10s-per-source-ip sliding window limit on the horizon /auth path. This provides some protection against credential stuffing attacks and will generate 429 response codes to the client and in the HAProxy log. The log could be used by an alerting system to detect potentially malicious traffic. The defined rate limit does not include traffic from rfc1918 addresses and this should be reviewed and overridden as necessary to protect the external API endpoint. Depends-On: https://review.opendev.org/c/openstack/openstack-ansible-haproxy_server/+/848657 Change-Id: I02ed08f9d3d12f7ad2e5dd3a45a699d766933877
Team and repository tags
OpenStack-Ansible
OpenStack-Ansible is an official OpenStack project which aims to deploy production environments from source in a way that makes it scalable while also being simple to operate, upgrade, and grow.
For an overview of the mission, repositories and related Wiki home page, please see the formal Home Page for the project.
For those looking to test OpenStack-Ansible using an All-In-One (AIO) build, please see the Quick Start guide.
For more detailed Installation and Operator documentation, please see the Deployment Guide.
If OpenStack-Ansible is missing something you'd like to see included, then we encourage you to see the Developer Documentation for more details on how you can get involved.
Developers wishing to work on the OpenStack-Ansible project should always base their work on the latest code, available from the master GIT repository at Source.
If you have some questions, or would like some assistance with
achieving your goals, then please feel free to reach out to us on the OpenStack Mailing Lists
(particularly openstack-discuss) or on IRC in
#openstack-ansible on the OFTC network.
OpenStack-Ansible Roles
OpenStack-Ansible offers separate role repositories for each individual role that OpenStack-Ansible supports. For individual role configuration options, see the Role Documentation.
An individual role's source code can be found at: https://opendev.org/openstack/openstack-ansible-<ROLENAME>.
Resources
- License: Apache License, Version 2.0
- Documentation: https://docs.openstack.org/openstack-ansible/latest/
- Source: https://opendev.org/openstack/openstack-ansible
- Bugs: https://bugs.launchpad.net/openstack-ansible
- Release notes: https://docs.openstack.org/releasenotes/openstack-ansible/