From b706833f4520e9b48ac1d4c1d8c440667c50b601 Mon Sep 17 00:00:00 2001 From: Pasindu Tennage Date: Tue, 14 Jul 2026 17:31:54 +0200 Subject: [PATCH 1/3] Added dcos for /registry rate limits [ci] Signed-off-by: pasindutennage-da Signed-off-by: Pasindu Tennage --- .../deployment/kubernetes-deployment.mdx | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/docs-main/global-synchronizer/deployment/kubernetes-deployment.mdx b/docs-main/global-synchronizer/deployment/kubernetes-deployment.mdx index b65099267..8306cfb73 100644 --- a/docs-main/global-synchronizer/deployment/kubernetes-deployment.mdx +++ b/docs-main/global-synchronizer/deployment/kubernetes-deployment.mdx @@ -1144,7 +1144,7 @@ Each SV is required to configure their cluster ingress to allow traffic from the - `https://sv.sv./api/sv` should be routed to `/api/sv` at port 5014 of service `sv-app` in the `sv` namespace. - `https://scan.sv.` should be routed to service `scan-web-ui` in the `sv` namespace. - `https://scan.sv./api/scan` should be routed to `/api/scan` at port 5012 in service `scan-app` in the `sv` namespace. -- `https://scan.sv./registry` should be routed to `/registry` at port 5012 in service `scan-app` in the `sv` namespace. +- `https://scan.sv./registry` should be routed to `/registry` at port 5012 in service `scan-app` in the `sv` namespace. This endpoint should be publicly accessible without any IP restrictions. - `https://cns.sv.` should be routed to service `ans-web-ui` in the `sv` namespace. - `https://cns.sv./api/validator` should be routed to `/api/validator` at port 5003 of service `validator-app` in the `sv` namespace. - `https://sequencer-.sv.` should be routed to port 5008 of service `global-domain--sequencer` in the `sv` namespace. @@ -1156,6 +1156,18 @@ Each SV is required to configure their cluster ingress to allow traffic from the To keep the attack surface on your SV deployment and the Global Synchronizer small, please disallow ingress connections to all other services in your SV deployment. It should be assumed that opening up *any* additional port or service represents a security risk that needs to be carefully evaluated on a case-by-case basis. +### Rate-limiting Public Endpoints + +Because the `/registry` endpoints must be publicly accessible, you must explicitly configure your Istio mesh to allow public traffic to these routes while rate-limiting them to prevent Denial of Service (DoS) attacks. +We recommend configuring the following rate limits for the `/registry` endpoints using your preferred rate-limiting mechanism: + +* **For Transfer Factory endpoints** (`/registry/transfer-instruction/v1/transfer-factory` and `/registry/transfer-instruction/v2/transfer-factory`): + * **Global limit:** 500 requests per minute + * **Per-IP limit:** 50 requests per minute +* **For all other `/registry/*` endpoints:** + * **Global limit:** 200 requests per minute + * **Per-IP limit:** 30 requests per minute + Internet ingress configuration is often specific to the network configuration and scenario of the cluster being configured. To illustrate the basic requirements of an SV node ingress, we have provided a Helm chart that configures the above cluster according to the routes above, as detailed in the sections below. Your SV node should be configured with a url to your `global-domain-sequencer` so that other validators can subscribe to it. From 3871729f0c480255aa5f650e737200d232fde728 Mon Sep 17 00:00:00 2001 From: Pasindu Tennage Date: Thu, 16 Jul 2026 09:55:21 +0200 Subject: [PATCH 2/3] Addressed feedback [ci] Signed-off-by: pasindutennage-da Signed-off-by: Pasindu Tennage --- .../deployment/kubernetes-deployment.mdx | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/docs-main/global-synchronizer/deployment/kubernetes-deployment.mdx b/docs-main/global-synchronizer/deployment/kubernetes-deployment.mdx index 8306cfb73..3e4d4eea7 100644 --- a/docs-main/global-synchronizer/deployment/kubernetes-deployment.mdx +++ b/docs-main/global-synchronizer/deployment/kubernetes-deployment.mdx @@ -1158,15 +1158,12 @@ To keep the attack surface on your SV deployment and the Global Synchronizer sma ### Rate-limiting Public Endpoints -Because the `/registry` endpoints must be publicly accessible, you must explicitly configure your Istio mesh to allow public traffic to these routes while rate-limiting them to prevent Denial of Service (DoS) attacks. -We recommend configuring the following rate limits for the `/registry` endpoints using your preferred rate-limiting mechanism: - -* **For Transfer Factory endpoints** (`/registry/transfer-instruction/v1/transfer-factory` and `/registry/transfer-instruction/v2/transfer-factory`): - * **Global limit:** 500 requests per minute - * **Per-IP limit:** 50 requests per minute -* **For all other `/registry/*` endpoints:** - * **Global limit:** 200 requests per minute - * **Per-IP limit:** 30 requests per minute +Because the `/registry` endpoints must be publicly accessible, you must explicitly configure your networking infrastructure to allow public traffic to these routes while rate-limiting them to prevent Denial of Service (DoS) attacks. + +We recommend configuring the following rate limits for each `/registry` endpoint using your preferred rate-limiting mechanism: + + * **Global rate limit:** 720 requests per minute + * **Per-IP rate limit:** 120 requests per minute Internet ingress configuration is often specific to the network configuration and scenario of the cluster being configured. To illustrate the basic requirements of an SV node ingress, we have provided a Helm chart that configures the above cluster according to the routes above, as detailed in the sections below. From 60ffcd9e6eee09d0a6c8726d296089677c1a5ce2 Mon Sep 17 00:00:00 2001 From: Pasindu Tennage Date: Thu, 16 Jul 2026 10:12:10 +0200 Subject: [PATCH 3/3] Applied feedback [ci] Signed-off-by: pasindutennage-da Signed-off-by: Pasindu Tennage --- .../global-synchronizer/deployment/kubernetes-deployment.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs-main/global-synchronizer/deployment/kubernetes-deployment.mdx b/docs-main/global-synchronizer/deployment/kubernetes-deployment.mdx index 3e4d4eea7..cbeaedae1 100644 --- a/docs-main/global-synchronizer/deployment/kubernetes-deployment.mdx +++ b/docs-main/global-synchronizer/deployment/kubernetes-deployment.mdx @@ -1144,7 +1144,7 @@ Each SV is required to configure their cluster ingress to allow traffic from the - `https://sv.sv./api/sv` should be routed to `/api/sv` at port 5014 of service `sv-app` in the `sv` namespace. - `https://scan.sv.` should be routed to service `scan-web-ui` in the `sv` namespace. - `https://scan.sv./api/scan` should be routed to `/api/scan` at port 5012 in service `scan-app` in the `sv` namespace. -- `https://scan.sv./registry` should be routed to `/registry` at port 5012 in service `scan-app` in the `sv` namespace. This endpoint should be publicly accessible without any IP restrictions. +- `https://scan.sv./registry` should be routed to `/registry` at port 5012 in service `scan-app` in the `sv` namespace. These endpoints should be publicly accessible without any IP restrictions as they are required for dApps to interact with Canton Coin. - `https://cns.sv.` should be routed to service `ans-web-ui` in the `sv` namespace. - `https://cns.sv./api/validator` should be routed to `/api/validator` at port 5003 of service `validator-app` in the `sv` namespace. - `https://sequencer-.sv.` should be routed to port 5008 of service `global-domain--sequencer` in the `sv` namespace.