Added rate limiting to ingress

Author: jakeymac

app/app.py

@@ -2,16 +2,11 @@
 
 from flask import Flask, request
 from flask_cors import CORS
-from flask_limiter import Limiter
-from flask_limiter.util import get_remote_address
 
 from blueprint_pages import app as blueprint_pages
 import v2
 import v1
 
-def real_ip():
-    return request.headers.get("X-Forwarded-For", request.remote_addr).split(",")[0].strip()
-
 print("Launching Flask App")
 
 api_path = os.getenv('API_PREFIX', '/api')
@@ -23,13 +18,6 @@ def real_ip():
 cors = CORS(app)
 app.config['CORS_HEADERS'] = '*'
 
-limiter = Limiter(
-    app=app,
-    key_func=real_ip,
-    default_limits=["5 per minute"],
-    headers_enabled=True
-)
-
 # >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> HTML PAGES
 app.register_blueprint(blueprint_pages)
 

app/v2/response_formatters.py

@@ -38,7 +38,7 @@ def clean_value(value):
 
     return {
         'metadata': {
-            'api_test_version': 'v1.23',
+            'api_test_version': 'v1.24',
             'river_id': river_id,
             'gen_date': datetime.datetime.now(datetime.UTC).strftime('%Y-%m-%dT%X+00:00'),
             'start_date': clean_value(start_date),

helm/gsprestapi/templates/ingress-rate-limit.yaml

@@ -0,0 +1,34 @@
+{{- if .Values.rateLimitedIngress.enabled -}}
+{{- $fullName := include "gsprestapi.fullname" . -}}
+
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ $fullName }}-ratelimit
+  namespace: {{ .Release.Namespace }}
+  labels:
+{{ include "gsprestapi.labels" . | indent 4 }}
+
+  annotations:
+{{ toYaml .Values.rateLimitedIngress.annotations | indent 4 }}
+
+spec:
+  ingressClassName: nginx
+
+  rules:
+  {{- range .Values.rateLimitedIngress.hosts }}
+  - host: {{ .host }}
+    http:
+      paths:
+      {{- range .paths }}
+      - path: {{ . }}
+        pathType: Prefix
+        backend:
+          service:
+            name: {{ $fullName }}
+            port:
+              name: http
+      {{- end }}
+  {{- end }}
+
+{{- end }}

helm/gsprestapi/values.yaml

@@ -35,6 +35,20 @@ ingress:
     - geoglows.ecmwf.int
     secretName: geoglows-tls
 
+rateLimitedIngress:
+  enabled: true
+
+  annotations:
+    nginx.ingress.kubernetes.io/limit-rps: "5"
+    nginx.ingress.kubernetes.io/limit-burst: "3"
+
+  hosts:
+  - host: geoglows-stage.ecmwf.int
+    paths:
+      - /api/v2/retrospective
+      - /api/v2/forecastensemble
+      - api/v2/forecastrecords
+
 resources:
   requests:
     cpu: 1