I have been trying to setup rate limiting using EnvoyFilters following the steps mentioned in this doc https://istio.io/latest/docs/tasks/policy-enforcement/rate-limit/.
But it’s not working as expected. Global rate limiting is not working in particular. It shows 500 response code for all the requests. But local rate limiting seems to be working fine.
This is the redis config that I am using
apiVersion: v1
kind: Service
metadata:
name: redis
labels:
app: redis
spec:
ports:
- name: grpc
port: 6379
targetPort: 6379
protocol: TCP
selector:
app: redis
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: redis
spec:
replicas: 1
selector:
matchLabels:
app: redis
template:
metadata:
labels:
app: redis
spec:
containers:
- image: redis:alpine
imagePullPolicy: Always
name: redis
resources:
requests:
memory: "64Mi"
cpu: "250m"
limits:
memory: "528Mi"
cpu: "500m"
ports:
- name: redis
containerPort: 6379
protocol: TCP
restartPolicy: Always
And this is the config for the rate limit app. It’s based on this app GitHub - envoyproxy/ratelimit: Go/gRPC service designed to enable generic rate limit scenarios from different types of applications.
apiVersion: v1
kind: Service
metadata:
name: ratelimit
labels:
app: ratelimit
spec:
type: ClusterIP
ports:
- port: 6070
targetPort: http-debug
protocol: TCP
name: http-debug
- port: 8081
targetPort: grpc-server
protocol: TCP
name: grpc-server
- port: 8080
targetPort: http-server
protocol: TCP
name: http-server
selector:
app: ratelimit
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: ratelimit
labels:
app: ratelimit
spec:
replicas: 1
selector:
matchLabels:
app: ratelimit
template:
metadata:
labels:
app: ratelimit
spec:
containers:
- env:
- name: LOG_LEVEL
value: debug
- name: LOG_FORMAT
value: JSON
- name: REDIS_SOCKET_TYPE
value: tcp
- name: REDIS_URL
value: redis.default.svc.cluster.local:6379
- name: USE_STATSD
value: "false"
- name: RUNTIME_ROOT
value: /data
- name: RUNTIME_SUBDIRECTORY
value: ratelimit
name: ratelimit
image: envoyproxy/ratelimit:v1.4.0
imagePullPolicy: IfNotPresent
resources:
limits:
cpu: 500m
memory: 528Mi
requests:
cpu: 250m
memory: 64Mi
command: ["/bin/ratelimit"]
ports:
- name: http-debug
containerPort: 6070
- name: grpc-server
containerPort: 8081
- name: http-server
containerPort: 8080
volumeMounts:
- name: commonconfig-volume
mountPath: /data/ratelimit/config/config.yaml
subPath: config.yaml
volumes:
- name: commonconfig-volume
configMap:
name: ratelimit-config
The EnvoyFilters and the ConfigMap are used from the Isito doc mentioned earlier. Any help would be much appreciated.
I have searched for months. Then settled down with the Kustomize based approach.