access: quick option to limit load

[diegodelemos]

During the coming workshop and after we might be subject of attacks or mistakes in user's scripts, which could lead to high amount of requests coming to REANA. We should prevent this:

• Check whether lightweight accounts can login to REANA.
• Check how to block IPs, like iptables or modevasive for Traefik and flask-ratelimiter for REANA-Server.
• Improve uwsgi configuration.
• Investigate how to block users who try to exploit the system

Observations: Flask running the web app only in R-J-C for now, and the performance is good.

[diegodelemos]

Maximum number of requests per user by configuring Traefik, following the docs (tested in reana-qa.cern.ch):

$ cat rate-limit.yaml
apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: main-ratelimit
spec:
  rateLimit:
      average: 50
      burst: 25
$ kubectl create -f rete-limit.yaml
$ for i in {1..100}; do curl -k "https://reana-qa.cern.ch/api/workflows?access_token=$REANA_ACCESS_TOKEN" &; done
$ # reaches the limit, and next requests get:
$ curl -k "https://reana-qa.cern.ch/api/workflows?access_token=$REANA_ACCESS_TOKEN"                                                                                                           
{                                                                                                                                                                                                                                      
  "message": "60 per 1 minute",                                                                                                                                                                                                        
  "status": 429                                                                                                                                                                                                                        
}

I will leave the issue opened in the backlog as the stress tests can bring the need to change something here, if there is no need we will move it to Awesome-Workshop-Morrows.

[diegodelemos]

Moved back to Ready for work, what is left: decide the numbers to limit the load to.