feat(manager): add API throttling

common/config.py

@@ -100,6 +100,7 @@ def __init__(self):
         self.public_port = 8000
         self.private_port = 8000
         self.max_request_size = int(os.getenv("MAX_REQUEST_SIZE_MB", "2"))
+        self.api_max_rps = int(os.getenv("API_MAX_RPS", "20"))  # maximum requests per second and account
 
         self.is_fedramp = strtobool(os.getenv("IS_FEDRAMP", "FALSE"))
 

conf/manager.env

@@ -4,3 +4,4 @@ DISABLE_RBAC=FALSE
 GRANULAR_RBAC=FALSE
 MAX_REQUEST_SIZE_MB=2
 MAXIMUM_PAGE_SIZE=1000
+API_MAX_RPS=100

manager/main.py

@@ -8,6 +8,8 @@
 import connexion
 from connexion.resolver import RestyResolver
 from flask import abort
+from flask_limiter import Limiter
+from flask_limiter.util import get_remote_address
 from peewee import OperationalError
 from prometheus_client import CollectorRegistry
 from prometheus_client import generate_latest
@@ -46,6 +48,8 @@ def create_app(spec_files, wait_on_cyndi=True):
     app.add_error_handler(MissingEntitlementException, forbidden_missing_entitlement)
     app.add_error_handler(RbacException, forbidden_rbac)
 
+    limiter = Limiter(app=app.app, key_func=get_remote_address)
+
     @app.app.route('/metrics', methods=['GET'])
     def metrics():  # pylint: disable=unused-variable
         # /metrics API shouldn't be visible in the API documentation, hence it's added here in the create_app step
@@ -69,6 +73,12 @@ def set_default_headers(response):  # pylint: disable=unused-variable
 
         return response
 
+    # Apply global throttling for all routes
+    @app.app.before_request
+    @limiter.limit(f"{CFG.api_max_rps} per second", key_func=lambda: connexion.request.headers.get("x-rh-identity"))
+    def account_level_throttle():
+        return
+
     # This hook ensures that a connection is opened to handle any queries
     # generated by the request.
     @app.app.before_request