cubeops: key the login rate limiter on the real peer IP, and bound the failure map - #1378

Open

dwin-gharibi wants to merge 9 commits into

TencentCloud:masterfrom

dwin-gharibi:cubeops-login-ratelimit-xff-bypass

Commits on Aug 19, 2026

fix(CubeOps/internal/server/server.go): adding key the login rate limiter on the real peer IP, and bound the failure map
dwin-gharibi
committed
d7f7287
test(CubeOps/internal/auth/ratelimit_xff_test.go): adding up the xff test on changes
dwin-gharibi
committed
865acf7
fix(CubeOps/internal/auth/ratelimit.go): cap the failure map and ship trusted_proxies defaults
dwin-gharibi
committed
7272e98
test(CubeOps/internal/auth/ratelimit_xff_test.go): exercise the sweep and eviction with distinct IPs
dwin-gharibi
committed
b3cdec2
fix(deploy/kubernetes/chart/values.yaml): default to trusting no proxy and reject trust-all CIDRs
dwin-gharibi
committed
7a87a5d
test(CubeOps/internal/config/config_trusted_proxies_test.go): cover trusted_proxies validation
dwin-gharibi
committed
6dcacd2
fix(CubeOps/internal/config/config.go): trim trusted_proxies entries and warn on broad or empty sets
dwin-gharibi
committed
1c3d442
test(CubeOps/internal/auth/ratelimit_xff_test.go): make the eviction test reach the threshold
dwin-gharibi
committed
45ee72f

Commits on Aug 21, 2026

test(CubeOps/e2e/login_ratelimit_xff_test.go): drive the XFF bypass against the real binary
dwin-gharibi
committed
2a37c64