Improve HTTP rate limiting classes and keys

[adriansmares]

Summary

This PR allows more fine grained control of HTTP endpoint rate limiting, by adding a class which includes the path template. This allows rate limiting individual HTTP endpoints (like http:account:/oauth/api/auth/login) next to the full class (like http:account).

Paths which contain a template (containing a gateway ID for example) will maintain their template form (like http:gcs:/api/v3/gcs/gateways/{gateway_id}/semtechudp/global_conf.json).

Changes

• Ensure that rate limiting middlewares are called after the authorization header has been converted to gRPC metadata.
• Use the API token ID as an identifier of the caller, instead of the IP, when available. The IP is still used when there is no authorization available.
• Add path template classes to HTTP rate limiting.

Testing

Add the following rate limiting configuration to your stack configuration file:

rate-limiting:
  profiles:
    - name: HTTP Account login
      max-per-min: 5
      associations:
        - http:account:/oauth/api/auth/login

Then try to login with a wrong password 5 times - you should get a rate limiting error.

Regressions

There is a behavioral change regarding the caller identity - using different API keys with the same caller IP will now have individual rate limits, which can allow more calls for a single source IP. This should allow better cloud-to-cloud connectivity via HTTP APIs (of which there aren't many, but still), and I consider it to be a reasonable change.

Checklist

• Scope: The referenced issue is addressed, there are no unrelated changes.
• Compatibility: The changes are backwards compatible with existing API, storage, configuration and CLI, according to the compatibility commitments in README.md for the chosen target branch.
• Documentation: Relevant documentation is added or updated.
• The steps/process to test this feature are clearly explained including testing for regressions.
• Changelog: Significant features, behavior changes, deprecations and fixes are added to CHANGELOG.md.
• Commits: Commit messages follow guidelines in CONTRIBUTING.md, there are no fixup commits left.

[KrishnaIyer]

Beat me to it. Good stuff!

[KrishnaIyer]

@adriansmares: Shall we try to get this into v3.28.1?

[johanstokking]

Regressions

There is a behavioral change regarding the caller identity - using different API keys with the same caller IP will now have individual rate limits, which can allow more calls for a single source IP. This should allow better cloud-to-cloud connectivity via HTTP APIs (of which there aren't many, but still), and I consider it to be a reasonable change.

Yep that's definitely reasonable.

[kschiffer]

Codeowned LGTM

[adriansmares]

@adriansmares: Shall we try to get this into v3.28.1?

I don't consider that we need these fine grained controls in the release. We'll add however some generic limits to our deployment templates.