snapp-incubator / cerberus Goto Github PK

At the moment, Cerberus is able to authenticate a user through the access token. However, there is a need for the quota, which can be defined on AccessToken or WebServiceAccessBinding CRDs. The latter is preferred since the quota can be fine-grained on the service level, hence less confusing.

The quota, eventually, should be persisted to prevent billing loss on Cerberus restarts. Redis is an option as an in-memory database.

Here are the proposed phases for the quota feature request:

1. Quota defined as a spec on WebServiceAccessBinding CRD, and the operator must deny requests in which their access token quota is exceeded. In this phase, the quota is ephemeral (not persisted).
2. Quota is persisted in a database.
3. Billings and remaining quota can be observed in a panel requesting to the operator database.

We don't use JWT, so it is safe to upgrade.