SolvedAPI & Developers

Getting 429 from the check-in endpoint in our Kubernetes cluster

Asked by Kwame Mensah9 days ago
We moved our cron jobs into Kubernetes and now some heartbeat check-ins fail with 429. Each job pings its own heartbeat and none of them run more than once a minute individually, so I do not understand why we are being rate limited.
Accepted answer from MonoDuty Support
Elif KayaMonoDuty Support Engineer7 days ago
Ninety jobs firing at the top of the minute would exceed the budget instantly. Things you can do today: 1. Stagger your schedules. Rather than everything at minute zero, spread jobs across the minute or across several minutes. In Kubernetes this usually means varying the cron expression rather than the code. This is the single most effective fix. 2. Add a small random delay before the ping in jobs you cannot reschedule. Even a few seconds of jitter spreads the load enough. 3. Retry the ping on failure. Curl can do this with a retry flag, so a rejected request is re-attempted a moment later rather than lost. Since a failed ping means the heartbeat may be marked overdue, this is worth adding regardless. 4. If you have several egress addresses available, distributing jobs across them raises the effective ceiling, though this is more of a workaround than a fix. I have also passed this to our development team as feedback, because keying this limit by token rather than by IP would be the correct behaviour for exactly your scenario. In the meantime, staggering should resolve it completely at your scale. For reference the other public endpoint, the alert trigger, is limited to 30 per minute per IP, so the same consideration applies if you fire alerts from the same cluster.
Was this helpful?77 of 79 found this helpful

3 replies

Elif KayaMonoDuty Support Engineer9 days ago

Hi Kwame, this is a genuinely tricky one and your reasoning is right for a single heartbeat. The catch is how the limit is keyed: the check-in endpoint allows 60 requests per minute per source IP address, not per token. Your cluster almost certainly egresses through a single NAT address, so every heartbeat behind it shares one 60 per minute budget.

Kwame Mensah8 days ago

That explains it, we have about 90 jobs and many of them are scheduled on the same minute boundary.

Kwame Mensah6 days ago

Staggered the schedules across five minutes and added retries. No 429s since. Thanks for the clear explanation.