Small question regarding using local_rate_limiter in my Kubernetes (1.18) cluster + Istio 1.8.x
few points:
- I want to avoid installing a redis image in my cluster
- I use istio and several have hundreds of Istio’s VirtualServices (its a special single tenant setup). Ofcourse, each one has a matching K8s service.
- I want to use headers query rate limiter as I allow more reads than writes for my application.
- I can also use port as I know my application is listening on port 8000
so now need to choose between ROUTE_CONFIGURATION or patching HTTP_ROUTE . not sure which is more suitable and more efficient for my needs.
HTTP_ROUTE seems to be the best choice
I was able to achieve simple port level rate limiter to work but still fighting the POST/GET separation.
what am I missing here
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: local-ratelimit-envoy-filter
namespace: istio-system
spec:
workloadSelector:
labels:
app: my_app_label
configPatches:
- applyTo: HTTP_FILTER
listener:
filterChain:
filter:
name: "envoy.filters.network.http_connection_manager"
patch:
operation: INSERT_BEFORE
value:
name: envoy.filters.http.local_ratelimit
typed_config:
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
type_url: type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
value:
stat_prefix: http_local_rate_limiter
- applyTo: HTTP_ROUTE
match:
context: SIDECAR_INBOUND
routeConfiguration:
vhost:
name: "inbound|http|8000"
route:
action: ANY
patch:
operation: MERGE
value:
typed_per_filter_config:
envoy.filters.http.local_ratelimit:
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
type_url: type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
value:
stat_prefix: http_local_rate_limiter
token_bucket:
max_tokens: 3
tokens_per_fill: 3
fill_interval: 60s
filter_enabled:
runtime_key: local_rate_limit_enabled
default_value:
numerator: 100
denominator: HUNDRED
filter_enforced:
runtime_key: local_rate_limit_enforced
default_value:
numerator: 100
denominator: HUNDRED
response_headers_to_add:
- append: false
header:
key: x-local-rate-limit
value: 'true'