Block specific pages domains through HAproxy
If the pages service is saturated you can view which pages domain is getting the most traffic and place a block for that domain through HAproxy.
See what domains are currently blocked
Section titled “See what domains are currently blocked”- Add the domain as a new line in deny-403-pages-domains.lst.
- Refresh mirror on ops by opening the section mirroring repositories and click on the refresh button.
- Run chef client on pages front end nodes with:
knife ssh -C 2 "roles:gprd-base-lb-pages" "sudo chef-client" - You can verify that the configuration is applied by checking
/etc/haproxy/front-end-security/deny-403-pages-domains.lston a haproxy node.
You can observe the rate at which haproxy denies front end requests in thanos.
You can also block individual IPs or apply net blocks.