Bug 1354145, added Using a Router Image to Protect Against DDoS Attacks

[ahardin-rh]

https://bugzilla.redhat.com/show_bug.cgi?id=1354145

[ahardin-rh]

@JacobTanenbaum Please review. Also, what are your thoughts on placement? Thanks!

[JacobTanenbaum]

I think this should be moved to the section "Deploying the default haproxy router". PR openshift/origin#9003 adds an environment variable (ROUTER_SLOWLORIS_TIMEOUT) to toggle defending the system against slow loris like attacks. I am also not sure exactly the best place to mention them but PR openshift/origin#9810 adds the ability to defend routes from various other DDoS type attacks, the annotations on the route affect the routes backend in the router template

[ahardin-rh]

@JacobTanenbaum Thanks for your suggestions! I captured the extra information you provided and also moved the content per your comments.

What are the benefits of setting timeout http-request vs. ROUTER_SLOWLORIS_TIMEOUT vs. the outlined HAProxy Template Router Settings? I think it would be helpful to provide a use case for each, or at least provide more clarity as to why a user would choose one method over the other. Thoughts? Thanks again!

[JacobTanenbaum]

haproxy.router.openshift.io/rate-limit-connections

[JacobTanenbaum]

setting the environment variable has the benefit of being part of the router template. The information is captured as part of the routers deployment configuration and does not require a user to hand modify the template.
Hand adding the haproxy setting would require the user to rebuild the router pod and maintain there own router template file with the change.

[ahardin-rh]

@JacobTanenbaum Thanks for your comments. This is now updated.

@adellape @tnguyen-rh Please peer review 🙇

[tnguyen-rh]

Maybe redundant in the current context, but i'd conditionalize the last sentence: "Otherwise, ... the connection, if CONDITION."

[tnguyen-rh]

@ahardin-rh A few stumbling points for me.

[ahardin-rh]

Approved by QE in BZ

[ahardin-rh]

[rev_history]
|xref:../install_config/install/deploy_router.adoc#install-config-install-deploy-router[Installing -> Deploying a Router]
|Added a new xref:../install_config/install/deploy_router.adoc#deploy-router-protecting-against-ddos-attack[Protecting Against DDoS Attacks] section.
%