Provide action limit configuration for each namespace (#5229)

* Provide action limit config for namespace

* Check namespace default limit

* Validate system limits and namespace default limits

* Fix test code

* Add system limit test

* Refactor code

* Reject message in invoker reactive

* Change config key

* Refactor code

* Add ansible config

* Update annotation for maxConcurrent

* Add test case for limit api

* Rename limit config key

* Update swagger

* Update document

* Add parameter size limit

* Refactor code

* Update limits API

* Rename allowedDuration -> allowedActionDuration

* Add test case for parameter limit

* Refactor code

* Add request payload limit for namespace

* Check activation result size with namespace payload limit

* Provide truncation size option for namespace

* Support scheduler

* Supports backwards compatibility for new limit config

* Update wskadmin

* Add parameter annotation for truncation

* Fix test code for KubernetesContainerTests

* Fix test code for DockerContainerTests

* Fix test cases

* Fix build error

* Fix build error

Author: upgle

ansible/environments/jenkins/group_vars/openwhisk-vm1-he-de

@@ -49,5 +49,7 @@ container_pool_akka_client: true
 runtimes_enable_concurrency: true
 limit_action_concurrency_max: 500
 
+namespace_default_limit_action_concurrency_max: 500
+
 invoker1_machine: openwhisk-vm3-he-de
 invoker_use_runc: false

ansible/environments/jenkins/group_vars/openwhisk-vm2-he-de

@@ -50,5 +50,7 @@ runtimes_enable_concurrency: true
 limit_action_concurrency_max: 500
 limit_invocations_per_minute: 120
 
+namespace_default_limit_action_concurrency_max: 500
+
 invoker1_machine: openwhisk-vm1-he-de
 invoker_use_runc: false

ansible/environments/jenkins/group_vars/openwhisk-vm3-he-de

@@ -49,5 +49,7 @@ container_pool_akka_client: true
 runtimes_enable_concurrency: true
 limit_action_concurrency_max: 500
 
+namespace_default_limit_action_concurrency_max: 500
+
 invoker1_machine: openwhisk-vm2-he-de
 invoker_use_runc: false

ansible/environments/local/group_vars/all

@@ -48,3 +48,4 @@ env_hosts_dir: "{{ playbook_dir }}/environments/local"
 container_pool_akka_client: true
 runtimes_enable_concurrency: true
 limit_action_concurrency_max: 500
+namespace_default_limit_action_concurrency_max: 500

ansible/roles/controller/tasks/deploy.yml

@@ -227,6 +227,15 @@
       "CONFIG_whisk_concurrencyLimit_max": "{{ limit_action_concurrency_max | default() }}"
       "CONFIG_whisk_concurrencyLimit_std": "{{ limit_action_concurrency_std | default() }}"
 
+      "CONFIG_whisk_namespaceDefaultLimit_memory_min": "{{ namespace_default_limit_action_memory_min | default() }}"
+      "CONFIG_whisk_namespaceDefaultLimit_memory_max": "{{ namespace_default_limit_action_memory_max | default() }}"
+
+      "CONFIG_whisk_namespaceDefaultLimit_timeLimit_min": "{{ namespace_default_limit_action_time_min | default() }}"
+      "CONFIG_whisk_namespaceDefaultLimit_timeLimit_max": "{{ namespace_default_limit_action_time_max | default() }}"
+
+      "CONFIG_whisk_namespaceDefaultLimit_concurrencyLimit_min": "{{ namespace_default_limit_action_concurrency_min | default() }}"
+      "CONFIG_whisk_namespaceDefaultLimit_concurrencyLimit_max": "{{ namespace_default_limit_action_concurrency_max | default() }}"
+
       "CONFIG_whisk_featureFlags_requireApiKeyAnnotation": "{{ whisk.feature_flags.require_api_key_annotation | default(true) | lower }}"
       "CONFIG_whisk_featureFlags_requireResponsePayload": "{{ whisk.feature_flags.require_response_payload | default(true) | lower }}"
 

ansible/roles/invoker/tasks/deploy.yml

@@ -279,6 +279,12 @@
       "CONFIG_whisk_concurrencyLimit_min": "{{ limit_action_concurrency_min | default() }}"
       "CONFIG_whisk_concurrencyLimit_max": "{{ limit_action_concurrency_max | default() }}"
       "CONFIG_whisk_concurrencyLimit_std": "{{ limit_action_concurrency_std | default() }}"
+      "CONFIG_whisk_namespaceDefaultLimit_memory_min": "{{ namespace_default_limit_action_memory_min | default() }}"
+      "CONFIG_whisk_namespaceDefaultLimit_memory_max": "{{ namespace_default_limit_action_memory_max | default() }}"
+      "CONFIG_whisk_namespaceDefaultLimit_timeLimit_min": "{{ namespace_default_limit_action_time_min | default() }}"
+      "CONFIG_whisk_namespaceDefaultLimit_timeLimit_max": "{{ namespace_default_limit_action_time_max | default() }}"
+      "CONFIG_whisk_namespaceDefaultLimit_concurrencyLimit_min": "{{ namespace_default_limit_action_concurrency_min | default() }}"
+      "CONFIG_whisk_namespaceDefaultLimit_concurrencyLimit_max": "{{ namespace_default_limit_action_concurrency_max | default() }}"
       "CONFIG_whisk_activation_payload_max": "{{ limit_activation_payload | default() }}"
       "CONFIG_whisk_transactions_header": "{{ transactions.header }}"
       "CONFIG_whisk_containerPool_akkaClient": "{{ container_pool_akka_client | default('false') | lower }}"

ansible/roles/schedulers/tasks/deploy.yml

@@ -191,6 +191,15 @@
       "CONFIG_whisk_concurrencyLimit_max": "{{ limit_action_concurrency_max | default() }}"
       "CONFIG_whisk_concurrencyLimit_std": "{{ limit_action_concurrency_std | default() }}"
 
+      "CONFIG_whisk_namespaceDefaultLimit_memory_min": "{{ namespace_default_limit_action_memory_min | default() }}"
+      "CONFIG_whisk_namespaceDefaultLimit_memory_max": "{{ namespace_default_limit_action_memory_max | default() }}"
+
+      "CONFIG_whisk_namespaceDefaultLimit_timeLimit_min": "{{ namespace_default_limit_action_time_min | default() }}"
+      "CONFIG_whisk_namespaceDefaultLimit_timeLimit_max": "{{ namespace_default_limit_action_time_max | default() }}"
+
+      "CONFIG_whisk_namespaceDefaultLimit_concurrencyLimit_min": "{{ namespace_default_limit_action_concurrency_min | default() }}"
+      "CONFIG_whisk_namespaceDefaultLimit_concurrencyLimit_max": "{{ namespace_default_limit_action_concurrency_max | default() }}"
+
       "RUNTIMES_MANIFEST": "{{ runtimesManifest | to_json }}"
       "CONFIG_whisk_runtimes_defaultImagePrefix":
         "{{ runtimes_default_image_prefix | default() }}"

common/scala/src/main/resources/application.conf

@@ -509,6 +509,9 @@ whisk {
         std = 1
     }
 
+    # maximum size of the action parameter
+    parameter-size-limit = 1 m
+
     # maximum size of the action code
     exec-size-limit = 48 m
 
@@ -517,6 +520,34 @@ whisk {
         default-list-limit = 30   # default limit on number of entities returned from a collection on a list operation
     }
 
+    # default namespace limit settings
+    # Disabled for backwards compatibility. If you want to use it, either uncomment it or add the setting at deployment time.
+    # namespace-default-limit {
+    #     memory {
+    #         min = 128 m
+    #         max = 512 m
+    #     }
+    #     time-limit {
+    #         min = 100 ms
+    #         max = 5 m
+    #     }
+    #     log-limit {
+    #         min = 0 m
+    #         max = 10 m
+    #     }
+    #     concurrency-limit {
+    #         min = 1
+    #         max = 1
+    #     }
+    #     parameter-size-limit = 1 m
+    #     activation {
+    #         payload {
+    #             max = 1 m
+    #             truncation = 1 m
+    #         }
+    #     }
+    # }
+
     yarn {
         master-url="http://localhost:8088" //YARN Resource Manager endpoint to be accessed from the invoker
         yarn-link-log-message=true //If true, display a link to YARN in the static log message, otherwise do not include a link to YARN.

common/scala/src/main/scala/org/apache/openwhisk/core/WhiskConfig.scala

@@ -222,6 +222,15 @@ object ConfigKeys {
   val timeLimit = "whisk.time-limit"
   val logLimit = "whisk.log-limit"
   val concurrencyLimit = "whisk.concurrency-limit"
+  val parameterSizeLimit = "whisk.parameter-size-limit"
+
+  val namespaceMemoryLimit = "whisk.namespace-default-limit.memory"
+  val namespaceTimeLimit = "whisk.namespace-default-limit.time-limit"
+  val namespaceLogLimit = "whisk.namespace-default-limit.log-limit"
+  val namespaceConcurrencyLimit = "whisk.namespace-default-limit.concurrency-limit"
+  val namespaceParameterSizeLimit = "whisk.namespace-default-limit.parameter-size-limit"
+  val namespaceActivationPayloadLimit = "whisk.namespace-default-limit.activation.payload"
+
   val activation = "whisk.activation"
   val userEvents = "whisk.user-events"
 

common/scala/src/main/scala/org/apache/openwhisk/core/connector/Message.scala

@@ -682,6 +682,8 @@ object ContainerCreationError extends Enumeration {
 
   case object TooManyConcurrentRequests extends ContainerCreationError
 
+  case object InvalidActionLimitError extends ContainerCreationError
+
   val whiskErrors: Set[ContainerCreationError] =
     Set(
       NoAvailableInvokersError,
@@ -705,6 +707,7 @@ object ContainerCreationError extends Enumeration {
     case "ZERONAMESPACELIMIT"               => ZeroNamespaceLimit
     case "TOOMANYCONCURRENTREQUESTS"        => TooManyConcurrentRequests
     case "UNKNOWNERROR"                     => UnknownError
+    case "INVALIDACTIONLIMITERROR"          => InvalidActionLimitError
   }
 
   implicit val serds = new RootJsonFormat[ContainerCreationError] {