Istio rate-limiting working incorrect

I configured rate-limiting correctly according to the istio tutorial, and it worked. But when I lowered the limit, it seemed that rate-limiting had not changed.Here are all my configuration files. I hope you can give me some help. Thank you very much.


apiVersion: config.istio.io/v1alpha2
kind: handler
metadata:
name: quotahandler
namespace: istio-system
spec:
compiledAdapter: memquota
params:
quotas:
- name: requestcountquota.instance.istio-system
maxAmount: 500
validDuration: 1s
# The first matching override is applied.
# A requestcount instance is checked against override dimensions.
overrides:
# The following override applies to ‘reviews’ regardless
# of the source.
# The following override applies to ‘productpage’ when
# the source is a specific ip address.
- dimensions:
destination: productpage
source: “10.28.11.20”
maxAmount: 500
validDuration: 1s
# The following override applies to ‘productpage’ regardless
# of the source.
- dimensions:
destination: productpage
maxAmount: 500 (Here I increased the number of requests per second.)
validDuration: 1s

At first, I configure it directly.

  • dimensions:
    Destination: product page
    MaxAmount: 1
    Valid Duration: 5S

Rate-limiting works well.

When I configure:

  • dimensions:
    Destination: product page
    MaxAmount: 500
    ValidDuration: 1s

The request will still return 429 in a short time,configuration (500/s) should be unrestricted at this time.During the test, I visited k8s product page service IP directly, such as curl 10.233.5.240:9080/product page.

I hope you can tell me why. Thank you very much for your answer.

Is it possible that your configuration had not yet taken effect during your test? There is some quota pre-fetching and caching within the proxy, and there may be some delay in configuration propagation to Mixer.

After I changed the configuration, after a long time, it still didn’t work.Can you tell me how to see if the configuration works from a lower level perspective? For example, the specific internal changes of istio after modification, which may be envoy configuration or other things. Thank you

This is due to insufficient allocation of policy deployment resources.

1 Like

Could be https://github.com/istio/istio/issues/3028 too

1 Like

Increasing the policy component resource solves this problem