SA: Add feature flag DisableLegacyLimitWrites (letsencrypt#7728)

features/features.go

@@ -117,6 +117,13 @@ type Config struct {
 	// to be the authoritative source of rate limiting information for
 	// new-account callers and disables the legacy rate limiting checks.
 	UseKvLimitsForNewAccount bool
+
+	// DisableLegacyLimitWrites when enabled, disables writes to:
+	//   - the newOrdersRL table at new-order time, and
+	//   - the certificatesPerName table at finalize time.
+	//
+	// This flag should only be used in conjunction with UseKvLimitsForNewOrder.
+	DisableLegacyLimitWrites bool
 }
 
 var fMu = new(sync.RWMutex)

sa/sa.go

@@ -380,7 +380,7 @@ func (ssa *SQLStorageAuthority) AddCertificate(ctx context.Context, req *sapb.Ad
 	_, rlTransactionErr := db.WithTransaction(ctx, ssa.dbMap, func(tx db.Executor) (interface{}, error) {
 		// Add to the rate limit table, but only for new certificates. Renewals
 		// don't count against the certificatesPerName limit.
-		if !isRenewal {
+		if !isRenewal && !features.Get().DisableLegacyLimitWrites {
 			timeToTheHour := parsedCertificate.NotBefore.Round(time.Hour)
 			err := ssa.addCertificatesPerName(ctx, tx, parsedCertificate.DNSNames, timeToTheHour)
 			if err != nil {
@@ -616,10 +616,12 @@ func (ssa *SQLStorageAuthority) NewOrderAndAuthzs(ctx context.Context, req *sapb
 		return nil, fmt.Errorf("casting error in NewOrderAndAuthzs")
 	}
 
-	// Increment the order creation count
-	err = addNewOrdersRateLimit(ctx, ssa.dbMap, req.NewOrder.RegistrationID, ssa.clk.Now().Truncate(time.Minute))
-	if err != nil {
-		return nil, err
+	if !features.Get().DisableLegacyLimitWrites {
+		// Increment the order creation count
+		err = addNewOrdersRateLimit(ctx, ssa.dbMap, req.NewOrder.RegistrationID, ssa.clk.Now().Truncate(time.Minute))
+		if err != nil {
+			return nil, err
+		}
 	}
 
 	return order, nil

test/config-next/sa.json

@@ -50,7 +50,8 @@
 		"healthCheckInterval": "4s",
 		"features": {
 			"MultipleCertificateProfiles": true,
-			"TrackReplacementCertificatesARI": true
+			"TrackReplacementCertificatesARI": true,
+			"DisableLegacyLimitWrites": true
 		}
 	},
 	"syslog": {