RFE-2924: Return HTTP 429 when route HTTP rate limit is exceeded

[sanjaytripathi97]

Summary

• When haproxy.router.openshift.io/rate-limit-connections.rate-http is exceeded, HAProxy previously used tcp-request content reject, which dropped the connection with no HTTP status (clients saw "Empty reply from server").
• Change that path to http-request deny deny_status 429 so rate-limited HTTP clients receive HTTP 429 Too Many Requests.
• Leave concurrent-tcp and rate-tcp as tcp-request content reject (TCP-layer limits; no HTTP response is possible). Passthrough backends are unchanged (no rate-http there).
  Fixes: https://issues.redhat.com/browse/RFE-2924

Changes

• images/router/haproxy/conf/haproxy-config.template: use http-request deny deny_status 429 for rate-http.
• pkg/router/router_test.go: add TestConfigTemplate cases for edge and insecure backends.

Test plan

• CGO_ENABLED=1 go test -mod=vendor -count=1 -timeout 120s -v ./pkg/router/ -run 'TestConfigTemplate'
• Manual: annotate a route with rate-limit + low rate-http, exceed the limit, confirm response is 429 (not empty reply)
• Confirm concurrent-tcp / rate-tcp still reject without an HTTP status
• Confirm passthrough routes with TCP rate limits are unchanged

Summary by CodeRabbit

• Bug Fixes

  • HTTP requests exceeding configured per-route rate limits now receive a clear 429 Too Many Requests response instead of a generic rejection.
  • TCP connection limits continue to use connection-level rejection behavior.

• Tests

  • Added coverage for HTTP rate limiting on secure and non-secure routes.

[openshift-ci-robot]

@sanjaytripathi97: This pull request references RFE-2924 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the feature request to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• When haproxy.router.openshift.io/rate-limit-connections.rate-http is exceeded, HAProxy previously used tcp-request content reject, which dropped the connection with no HTTP status (clients saw "Empty reply from server").
• Change that path to http-request deny deny_status 429 so rate-limited HTTP clients receive HTTP 429 Too Many Requests.
• Leave concurrent-tcp and rate-tcp as tcp-request content reject (TCP-layer limits; no HTTP response is possible). Passthrough backends are unchanged (no rate-http there).
  Fixes: https://issues.redhat.com/browse/RFE-2924

Changes

• images/router/haproxy/conf/haproxy-config.template: use http-request deny deny_status 429 for rate-http.
• pkg/router/router_test.go: add TestConfigTemplate cases for edge and insecure backends.

Test plan

• CGO_ENABLED=1 go test -mod=vendor -count=1 -timeout 120s -v ./pkg/router/ -run 'TestConfigTemplate'
• Manual: annotate a route with rate-limit + low rate-http, exceed the limit, confirm response is 429 (not empty reply)
• Confirm concurrent-tcp / rate-tcp still reject without an HTTP status
• Confirm passthrough routes with TCP rate limits are unchanged

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

The HAProxy route template now responds with HTTP 429 when configured HTTP request-rate limits are exceeded. Tests cover this behavior for edge TLS and insecure backends.

Changes

HTTP rate limiting

Layer / File(s)	Summary
HTTP 429 rate-limit rule and coverage images/router/haproxy/conf/haproxy-config.template, pkg/router/router_test.go	The template replaces TCP rejection for HTTP rate limits with http-request deny and deny_status 429; tests validate thresholds of 40 for edge TLS and 10 for insecure backends.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The added test titles are hardcoded map keys passed to t.Run; no generated IDs, timestamps, or other dynamic values appear in titles.
Test Structure And Quality	✅ Passed	PASS: The new tests are table-driven, each case checks one directive, and the harness already cleans up routes and uses bounded waits.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; pkg/router/router_test.go uses testing.T only, so MicroShift API restrictions don’t apply.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The added tests are table-driven config-template checks, not Ginkgo e2e tests, and they make no node/topology assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	Only HAProxy request-rate handling and unit tests changed; no pod/deployment/controller or topology/scheduling constraints were added.
Ote Binary Stdout Contract	✅ Passed	PR only changes HAProxy template and TestConfigTemplate cases; no new stdout writes were added in main/init/TestMain/setup code.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only a config template and a plain unit test were changed; no new Ginkgo e2e tests, IPv4-only logic, or external connectivity were added.
No-Weak-Crypto	✅ Passed	Patch only changes rate-limit handling to HTTP 429 and adds tests; no new MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	PR only edits HAProxy template/test; no container/K8s manifests or privilege flags like privileged, hostNetwork, allowPrivilegeEscalation, or SYS_ADMIN appear.
No-Sensitive-Data-In-Logs	✅ Passed	The PR only changes HAProxy rate-limit behavior and adds tests; no new logging statements or sensitive-data outputs were introduced.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: route HTTP rate limits now return HTTP 429 when exceeded.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign thealisyed for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @sanjaytripathi97. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.