Loadbalancer

[volovyks]

No description provided.

[volovyks]

Docs:
https://github.com/terraform-google-modules/terraform-google-lb-http/tree/master/modules/serverless_negs
https://github.com/GoogleCloudPlatform/terraform-google-cloud-armor/blob/v1.2.0/README.md

[volovyks]

Probabl we will need to setup a domain in order to make it work.

[kmaus-near]

Update: I was able to sync with the team on this, and I think we might put MPC-recovery behind EMS, which I can configure CORS and rate limiting as well. We can even use the existing Cloud Run URL for testing until we can nail down a domain. I'll just need to know what the CORS policy should look like and what rate limits we want.

[volovyks]

@kmaus-near what is EMS?
Our prod is on near.org, we have not started with integration of other services.
@esaminu can you pleace help listing all the FE environments here?

[kmaus-near]

EMS (Endpoint Management System) is what sits in front of services and acts as a loadbalancer. It uses Kong Ingress controller on our K8s cluster. Currently it sits in front of services like queryAPI, Enhanced API, and the FastAuth relayer. Currently we typically rate limit via Kong consumers that utilize and API key sent with request headers, but it can be configured to use other methods as well (consumer, credential, ip, service, header, and path). Once I have the CORS policy you guys want to use I can have this set up relatively quickly.

[esaminu]

After near/near-discovery#336 is merged, the relayer will be targeted by near discovery domains and signer app domains but the mpc recovery service will only be targeted by signer app domains. Currently everything is targeted by near discovery domains.

For near discovery we have:

• near.org
• test.near.org
• deploy previews

For the signer app we have

• wallet.near.org
• wallet.testnet.near.org
• wallet.staging.near.org
• (deploy previews will be added at some point)

Does this help answer the question?

[volovyks]

Thank you @esaminu !
Should we wait for that merge? Or can we allowlist it according to those domains now?

[kmaus-near]

Got some follow up questions from the team with a request:

If you guys happen to have a diagram and flow chart you guys could share with us so we can get a better picture of the entire MPC architecture that would be awesome.

Also there's a question as to why CORS will be changing so frequently vs allowing all origins, and will probably have to run that by the security team if that's the case.

Rate limiting is pretty easily configurable so changing that frequently shouldn't be an issue, the main concern is CORS policy and a data flow/architecture diagram for more context into the environments.

Thanks guys!

[esaminu]

@volovyks I think we should allowlist everything for the mpc recovery service and then remove the near discovery domains once the release is live and stable

[volovyks]

@esaminu everything is allowlisted and there is no ratelimiting now. But we want to add it. I agree that that is not critical since we do not have a lot of partners at the moment.

[volovyks]

@kmaus-near Here is a 10 minute schema: https://miro.com/app/board/uXjVMkxMEZk=/?share_link_id=827371266226
Maybe it will help you. Tell me if you need something more specific.

[volovyks]

Synced with @kmaus-near and @esaminu. We desided to stick the the EMS rate limiting and skip the corse protection since it's covered with rate limiting.

For the rate limiting we agreed on next setup:

• /mpc_public_key - 100 requests per second per domain
• /claim_oidc - 100 requests per second per domain
• /user_credentials - 100 requests per second per domain
• /new_account - 5 requests per second per domain
• /sign - 100
• /metrics - 100 requests per second per domain
• Requests to other endpoints should be allowed with overall limit of 500 requests per second per domain

The list of domains can be found in the comment above.

This limitations should be added to the newly created MPC Leader Node (@itegulov, please, post it here once we have it).

@kmaus-near tell me if there is any other blockers.

[volovyks]

The list of domains for prod is only

• near.org
• wallet.near.org

Everything elese is testnet/dev envs.
cc @kmaus-near @esaminu

[kmaus-near]

Do you guys have an example request I can make to test the rate limit? Everything should be ready to go, just need to verify that it works as intended.

[kmaus-near]

Also out of curiously, what is the driving force behind the planned Monday release? A few people are asking me on my end.

[volovyks]

@kmaus-near hard deadline :)