Istio Rate Limiting Not working

Policies and Telemetry
1

Hi,

I am using istio v1.0.0. I am trying to implement rate limiting for my services. When I hit the endpoint Service 1 will connects to service 2 and below is my rate-limit.yaml file.

apiVersion: config.istio.io/v1alpha2
kind: memquota
metadata:
  name: handler
  namespace: istio-system
spec:
  quotas:
  - name: requestcount.quota.istio-system
    maxAmount: 500
    validDuration: 1s
    overrides:
    - dimensions:
        destination: service-1
        source: service-2
      maxAmount: 2
      validDuration: 60s
---
apiVersion: config.istio.io/v1alpha2
kind: quota
metadata:
  name: requestcount
  namespace: istio-system
spec:
  dimensions:
    source: request.headers["x-forwarded-for"] | "unknown"
    destination: destination.labels["app"] | destination.service.name | "unknown"
    destinationVersion: destination.labels["version"] | "unknown"
---
apiVersion: config.istio.io/v1alpha2
kind: QuotaSpec
metadata:
  name: request-count
  namespace: default
spec:
  rules:
  - quotas:
    - charge: 1
      quota: requestcount
---
apiVersion: config.istio.io/v1alpha2
kind: QuotaSpecBinding
metadata:
  name: request-count
  namespace: istio-system
spec:
  quotaSpecs:
  - name: request-count
    namespace: default
  services:
      - service: '*'  # Uncomment this to bind *all* services to request-count
---
apiVersion: config.istio.io/v1alpha2
kind: rule
metadata:
  name: quota
  namespace: istio-system
spec:
  # quota only applies if you are not logged in.
  # match: match(request.headers["cookie"], "user=*") == false
  actions:
  - handler: handler.memquota
    instances:
    - requestcount.quota

When i apply this yaml file i am not able to get the error response. May I know where I have done mistake.

Regards,

2

The dimensions in overrides doesn’t look right.

overrides:
- dimensions:
destination: service-1
source: service-2

you have defined source as source: request.headers["x-forwarded-for"] | "unknown", which would be client ip address.
Please make sure value of your source and destination would be same as what defined by you.
You can use https://istio.io/docs/tasks/telemetry/logs/collecting-logs/ to look at the values of your dimensions.

3

Thanks @gargnupur. I just started working on this.

 overrides:
- dimensions:
destination: service-1

Here what is “destination” refers to --> either pod name or service name that helps for deployment or app name.

spec:
  dimensions:
    source: request.headers["x-forwarded-for"] | "unknown"

and value “unknown” will be taken by default value if it doesn’t match the “request.headers[“x-forwarded-for”]”. Am i right ?