I’m not able to see rate limit applied in istio 1.7 by applying the following scripts.
---
apiVersion: v1
kind: Namespace
metadata:
name: sock-shop
labels:
istio-injection: enabled
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: filter-ratelimit
namespace: istio-system
spec:
workloadSelector:
labels:
istio: ingressgateway
configPatches:
- applyTo: HTTP_FILTER
match:
context: GATEWAY
listener:
filterChain:
filter:
name: "envoy.http_connection_manager"
subFilter:
name: "envoy.router"
patch:
operation: INSERT_BEFORE
value:
name: envoy.rate_limit
config:
domain: sock-shop-ratelimit
rate_limit_service:
grpc_service:
envoy_grpc:
cluster_name: rate_limit_service
timeout: 0.25s
- applyTo: CLUSTER
match:
cluster:
service: ratelimit.rate-limit.svc.cluster.local
patch:
operation: ADD
value:
name: rate_limit_service
type: STRICT_DNS
connect_timeout: 0.25s
lb_policy: ROUND_ROBIN
http2_protocol_options: {}
hosts:
- socket_address:
address: ratelimit.rate-limit.svc.cluster.local
port_value: 8081
---
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: filter-ratelimit-svc
namespace: istio-system
spec:
workloadSelector:
labels:
istio: ingressgateway
configPatches:
- applyTo: VIRTUAL_HOST
match:
context: GATEWAY
routeConfiguration:
vhost:
name: "*:80"
route:
action: ANY
patch:
operation: MERGE
value:
# rate limit service descriptors config relays on the order of the request headers (desriptor_key)
rate_limits:
- actions:
- request_headers:
header_name: "x-plan"
descriptor_key: "plan"
- request_headers:
header_name: "x-account"
descriptor_key: "account"
apiVersion: v1
kind: Namespace
metadata:
name: rate-limit
labels:
istio-injection: enabled
---
apiVersion: v1
kind: Service
metadata:
name: redis
namespace: rate-limit
labels:
app: redis
spec:
ports:
- name: redis
port: 6379
selector:
app: redis
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: redis
namespace: rate-limit
spec:
replicas: 1
selector:
matchLabels:
app: redis
template:
metadata:
labels:
app: redis
spec:
containers:
- image: redis:alpine
imagePullPolicy: Always
name: redis
ports:
- name: redis
containerPort: 6379
restartPolicy: Always
serviceAccountName: ""
---
apiVersion: v1
kind: ConfigMap
metadata:
name: ratelimit-config
namespace: rate-limit
data:
# check this example: https://github.com/envoyproxy/ratelimit#example-4
config.yaml: |
domain: sock-shop-ratelimit
descriptors:
- key: plan
value: BASIC
descriptors:
- key: account
rate_limit:
unit: minute
requests_per_unit: 1
- key: plan
value: PLUS
descriptors:
- key: account
rate_limit:
unit: minute
requests_per_unit: 2
---
apiVersion: v1
kind: Service
metadata:
name: ratelimit
namespace: rate-limit
labels:
app: ratelimit
spec:
ports:
- name: "8080"
port: 8080
targetPort: 8080
protocol: TCP
- name: "8081"
port: 8081
targetPort: 8081
protocol: TCP
- name: "6070"
port: 6070
targetPort: 6070
protocol: TCP
selector:
app: ratelimit
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: ratelimit
namespace: rate-limit
spec:
replicas: 1
selector:
matchLabels:
app: ratelimit
strategy:
type: Recreate
template:
metadata:
labels:
app: ratelimit
spec:
containers:
- image: envoyproxy/ratelimit:v1.4.0
imagePullPolicy: Always
name: ratelimit
command: ["/bin/ratelimit"]
env:
- name: LOG_LEVEL
value: debug
- name: REDIS_SOCKET_TYPE
value: tcp
- name: REDIS_URL
value: redis:6379
- name: USE_STATSD
value: "false"
- name: RUNTIME_ROOT
value: /data
- name: RUNTIME_SUBDIRECTORY
value: ratelimit
ports:
- containerPort: 8080
- containerPort: 8081
- containerPort: 6070
volumeMounts:
- name: config-volume
mountPath: /data/ratelimit/config/config.yaml
subPath: config.yaml
volumes:
- name: config-volume
configMap:
name: ratelimit-config
---
Other than that I have deployed the istio bookinfo sample application
kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml
Configured istio ingress gateway route to this app
kubectl apply -f samples/bookinfo/networking/bookinfo-gateway.yaml
When I access the app through the ingress gateway by applying the associated rate limit headers
curl -I "http://"$GATEWAY_URL/productpage" --header 'x-plan: BASIC' --header 'x-account: user'
It keeps giving me 200 OK response doesn’t matter how many times I apply it although the applied rimit is 2 requests per minute.
Moreover when I try to see data in redis, I see no data there.
export REDIS_POD=$(kubectl get pod -n rate-limit | grep redis | awk '{ print $1 }')
kubectl -n rate-limit exec -it $REDIS_POD -c redis /bin/sh
redis-cli
keys *
Anyone help would be appreciated.
