[seokho-son]

GET /ns/{ns}/infra/{id} and GET /ns/{ns}/infra are the heaviest read APIs (full etcd read plus per-node hydration) and were capped at 2 req/s per client. Behind a gateway or NAT every GUI shares that budget, so normal polling from a few clients already hit rate limit exceeded, while each poll still cost a full read.

Changes

• Read cache (1 s) with singleflight for the Infra detail (default option) and Infra list (default/simple). Concurrent identical requests share one fetch; the result is reused for one second. Every write path (UpdateInfraInfo, UpdateNodeInfo, node create/delete, Infra create/delete) invalidates the Infra's entries, so a read right after a control request returns the new state. detail=true, accessinfo and status bypass the cache.
• Concurrency cap of 8 on the full Infra read; a request waiting longer than 3 s gets 503 with Retry-After: 1.
• Configurable rate limits via TB_API_RATE_LIMIT_GLOBAL (default 200:400), TB_API_RATE_LIMIT_INFRA_LIST (10:30), TB_API_RATE_LIMIT_INFRA_GET (5:15), in rate:burst form. 429 responses now carry Retry-After: 1. Documented in conf/setup.env.

Verification

• Unit tests: coalescing, invalidation, expiry, write-path invalidation, semaphore overflow.
• Live (2-node Infra): 10 concurrent detail reads served as one fetch; 40 back-to-back reads hit 429 only after the configured burst with Retry-After; a detail read right after a suspend request showed Suspending, not the cached Running.

Notes

• Defaults raised: list 2→10/s, detail 2→5/s, global 50→200/s. Clients should honor Retry-After on 429/503.
• Limits remain per client IP; XFF-based identification was intentionally not added.

[seokho-son]

/approve

[github-actions]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: seokho-son

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS [seokho-son]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment