Provide option to enforce network connection rate limiting

components/ws-daemon/nsinsider/main.go

@@ -490,6 +490,10 @@ func main() {
 						Name:     "bucketsize",
 						Required: false,
 					},
+					&cli.BoolFlag{
+						Name:     "enforce",
+						Required: false,
+					},
 				},
 				Action: func(c *cli.Context) error {
 					const drop_stats = "ws-connection-drop-stats"
@@ -500,6 +504,7 @@ func main() {
 					if bucketSize == 0 {
 						bucketSize = 1000
 					}
+					enforce := c.Bool("enforce")
 
 					// nft add table ip gitpod
 					gitpodTable := nftcon.AddTable(&nftables.Table{
@@ -534,6 +539,11 @@ func main() {
 						return err
 					}
 
+					verdict := expr.VerdictAccept
+					if enforce {
+						verdict = expr.VerdictDrop
+					}
+
 					// nft add rule ip gitpod ratelimit ip protocol tcp ct state new meter ws-connections
 					// '{ ip daddr & 0.0.0.0 timeout 1m limit rate over 3000/minute burst 1000 packets }' counter name ws-connection-drop-stats drop
 					nftcon.AddRule(&nftables.Rule{
@@ -613,7 +623,7 @@ func main() {
 							},
 							// drop
 							&expr.Verdict{
-								Kind: expr.VerdictAccept,
+								Kind: verdict,
 							},
 						},
 					})

components/ws-daemon/pkg/daemon/daemon.go

@@ -97,24 +97,28 @@ func NewDaemon(config Config, reg prometheus.Registerer) (*Daemon, error) {
 		return nil, xerrors.Errorf("cannot register cgroup plugin metrics: %w", err)
 	}
 
-	var configReloader CompositeConfigReloader
-	configReloader = append(configReloader, ConfigReloaderFunc(func(ctx context.Context, config *Config) error {
-		cgroupV1IOLimiter.Update(config.IOLimit.WriteBWPerSecond.Value(), config.IOLimit.ReadBWPerSecond.Value(), config.IOLimit.WriteIOPS, config.IOLimit.ReadIOPS)
-		cgroupV2IOLimiter.Update(config.IOLimit.WriteBWPerSecond.Value(), config.IOLimit.ReadBWPerSecond.Value(), config.IOLimit.WriteIOPS, config.IOLimit.ReadIOPS)
-		procV2Plugin.Update(config.ProcLimit)
-		return nil
-	}))
-
 	listener := []dispatch.Listener{
 		cpulimit.NewDispatchListener(&config.CPULimit, reg),
 		markUnmountFallback,
 		cgroupPlugins,
 	}
 
+	netlimiter := netlimit.NewConnLimiter(config.NetLimit, reg)
 	if config.NetLimit.Enabled {
-		listener = append(listener, netlimit.NewConnLimiter(config.NetLimit, reg))
+		listener = append(listener, netlimiter)
 	}
 
+	var configReloader CompositeConfigReloader
+	configReloader = append(configReloader, ConfigReloaderFunc(func(ctx context.Context, config *Config) error {
+		cgroupV1IOLimiter.Update(config.IOLimit.WriteBWPerSecond.Value(), config.IOLimit.ReadBWPerSecond.Value(), config.IOLimit.WriteIOPS, config.IOLimit.ReadIOPS)
+		cgroupV2IOLimiter.Update(config.IOLimit.WriteBWPerSecond.Value(), config.IOLimit.ReadBWPerSecond.Value(), config.IOLimit.WriteIOPS, config.IOLimit.ReadIOPS)
+		procV2Plugin.Update(config.ProcLimit)
+		if config.NetLimit.Enabled {
+			netlimiter.Update(config.NetLimit)
+		}
+		return nil
+	}))
+
 	dsptch, err := dispatch.NewDispatch(containerRuntime, clientset, config.Runtime.KubernetesNamespace, nodename, listener...)
 	if err != nil {
 		return nil, err

components/ws-daemon/pkg/netlimit/config.go

@@ -6,6 +6,7 @@ package netlimit
 
 type Config struct {
 	Enabled              bool  `json:"enabled"`
+	Enforce              bool  `json:"enforce"`
 	ConnectionsPerMinute int64 `json:"connectionsPerMinute"`
 	BucketSize           int64 `json:"bucketSize"`
 }

components/ws-daemon/pkg/netlimit/netlimit.go

@@ -48,10 +48,12 @@ func NewConnLimiter(config Config, prom prometheus.Registerer) *ConnLimiter {
 
 	s.config = config
 
-	prom.MustRegister(
-		s.droppedBytes,
-		s.droppedPackets,
-	)
+	if config.Enabled {
+		prom.MustRegister(
+			s.droppedBytes,
+			s.droppedPackets,
+		)
+	}
 
 	return s
 }
@@ -136,6 +138,9 @@ func (c *ConnLimiter) limitWorkspace(ctx context.Context, ws *dispatch.Workspace
 	err = nsinsider.Nsinsider(ws.InstanceID, int(pid), func(cmd *exec.Cmd) {
 		cmd.Args = append(cmd.Args, "setup-connection-limit", "--limit", strconv.Itoa(int(c.config.ConnectionsPerMinute)),
 			"--bucketsize", strconv.Itoa(int(c.config.BucketSize)))
+		if c.config.Enforce {
+			cmd.Args = append(cmd.Args, "--enforce")
+		}
 	}, nsinsider.EnterMountNS(false), nsinsider.EnterNetNS(true))
 	if err != nil {
 		log.WithError(err).WithFields(ws.OWI()).Error("cannot enable connection limiting")
@@ -171,3 +176,11 @@ func (c *ConnLimiter) limitWorkspace(ctx context.Context, ws *dispatch.Workspace
 
 	return nil
 }
+
+func (c *ConnLimiter) Update(config Config) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	c.config = config
+	log.WithField("config", config).Info("updating network connection limits")
+}

install/installer/pkg/components/ws-daemon/configmap.go

@@ -50,6 +50,7 @@ func configmap(ctx *common.RenderContext) ([]runtime.Object, error) {
 	var procLimit int64
 	networkLimitConfig := netlimit.Config{
 		Enabled:              false,
+		Enforce:              false,
 		ConnectionsPerMinute: 3000,
 		BucketSize:           1000,
 	}
@@ -74,6 +75,7 @@ func configmap(ctx *common.RenderContext) ([]runtime.Object, error) {
 		ioLimitConfig.ReadIOPS = ucfg.Workspace.IOLimits.ReadIOPS
 
 		networkLimitConfig.Enabled = ucfg.Workspace.NetworkLimits.Enabled
+		networkLimitConfig.Enforce = ucfg.Workspace.NetworkLimits.Enforce
 		networkLimitConfig.ConnectionsPerMinute = ucfg.Workspace.NetworkLimits.ConnectionsPerMinute
 		networkLimitConfig.BucketSize = ucfg.Workspace.NetworkLimits.BucketSize
 

install/installer/pkg/config/v1/experimental/experimental.go

@@ -77,6 +77,7 @@ type WorkspaceConfig struct {
 	} `json:"ioLimits"`
 	NetworkLimits struct {
 		Enabled              bool  `json:"enabled"`
+		Enforce              bool  `json:"enforce"`
 		ConnectionsPerMinute int64 `json:"connectionsPerMinute"`
 		BucketSize           int64 `json:"bucketSize"`
 	} `json:"networkLimits"`