[Openstack] [keystone] Rate limit middleware

Rafael Durán Castañeda rafadurancastaneda at gmail.com
Thu Jul 12 16:26:03 UTC 2012


On 07/12/2012 04:48 PM, Jay Pipes wrote:
> On 07/11/2012 07:28 PM, Rafael Durán Castañeda wrote:
>> Thank you guys for the info, I didn't know about some of the projects.
>> However writing my "on-house" own stuff is not what I was considering
>> but adding a middleware into Keystone, nothing fancy but extensible so
>> it covers at least most basic use cases, pretty much like nova
>> middleware. So , would you like to see something like that into keystone
>> or you don't?
> I think that's what Kevin was trying to say you didn't need to do, since
> Turnstile can already do that for you :) You simply insert the Turnstile
> Python WSGI middleware into the Paste deploy pipeline of Keystone, and
> then you get rate limiting in Keystone.
>
> You'd just add this into the Keystone paste.ini file:
>
> [filter:turnstile]
> paste.filter_factory = turnstile.middleware:turnstile_filter
> redis.host = <your Redis database host name or IP>
>
> And then insert the turnstile middleware in the Keystone pipeline, like so:
>
> [pipeline:public_api]
> pipeline = stats_monitoring url_normalize token_auth admin_token_auth
> xml_body json_body debug ec2_extension turnstile public_service
>
> The above should be a single line of course...
>
> And then configure Turnstile to your needs. See:
>
> http://code.activestate.com/pypm/turnstile/
>
> If you wanted to do some custom stuff, check out the custom Nova
> Turnstile middleware for an example:
>
> http://code.activestate.com/pypm/nova-limits/
>
> All the best,
> -jay
>
> _______________________________________________
> Mailing list: https://launchpad.net/~openstack
> Post to     : openstack at lists.launchpad.net
> Unsubscribe : https://launchpad.net/~openstack
> More help   : https://help.launchpad.net/ListHelp
Unless I'm missing something, nova_limits is not applicable to Keystone 
since it takes the tenant_id from 'nova.context', which obiously is not 
available for Keystone; thought adapt/extend it to keystone should be 
trivial and probably is the way to go.

Regards,
Rafael





More information about the Openstack mailing list