Request rate limiting

A single faulty or overly active client can consume all cluster resources. A rate limit quota restricts the number of requests per unit of time, and excess requests receive the 429 Too Many Requests response.

Goal

Limit the request rate to the secret/ secrets engine and make sure that exceeding the limit results in a 429 response.

Prerequisites

To follow this example, you need:

• A Stronghold token with permissions on sys/quotas/rate-limit/*.
• The curl utility.

Step 1. Create a quota

Create a quota of five requests per minute for the secret/ path:

d8 stronghold write sys/quotas/rate-limit/secret-limit path="secret/" rate=5 interval=60

Quota parameters:

The quota is counted separately for each client IP address.

Step 2. Check that the limit works

Send ten requests in a row:

for i in $(seq 1 10); do
  curl -s -o /dev/null -w "%{http_code}\n" -H "X-Vault-Token: $STRONGHOLD_TOKEN" "$STRONGHOLD_ADDR/v1/secret/data/probe"
done | sort | uniq -c

The first five requests succeed (the response is 404 because the probe secret does not exist, or 200), and the rest receive 429:

      5 404
      5 429

Requests to other paths, such as sys/health, are not affected by the quota.

Step 3. View and change the quota

List the quotas, read the quota parameters, and raise the limit to 100 requests per second:

d8 stronghold list sys/quotas/rate-limit
d8 stronghold read sys/quotas/rate-limit/secret-limit
d8 stronghold write sys/quotas/rate-limit/secret-limit path="secret/" rate=100 interval=1

After a change, the quota takes effect immediately.

Verification

Read the current quota limit:

d8 stronghold read -field=rate sys/quotas/rate-limit/secret-limit

The command returns 100.

Cleanup

Delete the quota:

d8 stronghold delete sys/quotas/rate-limit/secret-limit

Additional resources

• Quotas
• Quotas API