Add registration admission control for httpd

[pablomh]

Summary

Add registration admission control for /rhsm and /register endpoints via an Apache mod_proxy_balancer pool. When httpd_registration_admission_max > 0, requests beyond that limit are queued by Apache instead of overwhelming Puma during registration bursts.

Builds on top of #483 (MPM event module configuration).

Problem

Under high-concurrency registration (e.g., 912+ simultaneous hosts), all requests arrive at Puma simultaneously, creating a deep backlog where tail hosts exceed subscription-manager's 180s timeout. Without admission control, pass rates drop sharply above 760 concurrent.

Solution

A <Proxy balancer://foreman-registration> block with a max= limit on the BalancerMember directive limits how many registration requests reach Puma concurrently. Excess requests are held in Apache's event loop (non-blocking) until a slot opens.

The balancer block is injected conditionally in both foreman-ssl-vhost.conf.j2 and foreman-vhost.conf.j2 before the catch-all ProxyPass /, so /rhsm and /register match first while all other traffic (Web UI, API, Pulp) is unaffected.

Configuration

Disabled by default (httpd_registration_admission_max: 0). Tuning profiles set values based on puma_workers * threads * 5:

Profile	Value
default	0 (disabled)
medium	300
large	600
extra-large	1200
extra-extra-large	2400

Results (16-CPU large Satellite)

Level	Without throttle	With throttle (max=600)
912	72.8%	100%
1064	71.8%	99.8%
1368	72.5%	97.0%

Note

A similar mechanism could be implemented for foreman-installer deployments via puppet-foreman using the existing foreman::config::apache::fragment mechanism.

How to test

1. Deploy with a tuning profile: foremanctl deploy --tuning large
2. Verify throttle block: grep foreman-registration /etc/httpd/conf.d/foreman-ssl.conf
3. Verify config syntax: httpd -t
4. Register hosts concurrently and observe improved pass rates at high concurrency