Rate Limit Mitigation Strategies

Rate Limit Mitigation Strategies A workflow diagram generated by Archify. 01 / Decision 02 / Mitigation by environment 03 / Prevention and outcome Rate Limit Hit? · Decision · DECISION Rate Limit Hit? DECISION Your Environment · Decision · DECISION Your Environment DECISION ECR Pull-through Cache · AWS / EKS · pull-through cache rule · Mitigation by environment · STRATEGY 3 ECR Pull-through Cache AWS / EKS · pull-through cache rule STRATEGY 3 Harbor Proxy Cache · proxy cache project · Mitigation by environment · STRATEGY 1 Harbor Proxy Cache proxy cache project STRATEGY 1 containerd Mirror / Distribution · REGISTRY_PROXY_REMOTEURL · Mitigation by environment · STRATEGY 2 containerd Mirror / Distribution REGISTRY_PROXY_REMOTEURL STRATEGY 2 Authenticated Pulls · imagePullSecrets · Prevention and outcome · PREVENT Authenticated Pulls imagePullSecrets PREVENT Rate Limit Resolved · Prevention and outcome · RESULT Rate Limit Resolved RESULT self-hosted other no yes Legend Prevention Outcome Decision Self-managed cache AWS managed cache

Strategies on this page

  • • Strategy 1: Harbor proxy cache project pointing at registry-1.docker.io, wired in as a containerd mirror
  • • Strategy 2: CNCF Distribution registry mirror with REGISTRY_PROXY_REMOTEURL and cached layers on a PVC
  • • Strategy 3: Amazon ECR pull-through cache rule, pulling docker.io images via the ECR endpoint
  • • Strategy 4: pre-pull images to nodes with a DaemonSet for predictable workloads

Prevent instead of repair

  • • Authenticated pulls get a higher quota than anonymous pulls
  • • Store the Docker Hub token as a kubernetes.io/dockerconfigjson Secret
  • • Attach it via imagePullSecrets on the Pod or the ServiceAccount