For this setup, we're going to use the httpbin example that cames with istio. You can close this repo.
Basics, run the following do the setup
istioctl install --set profile=demo -y
kubectl label namespace default istio-injection=enabled
go into samples\httpbin directory and then run:
kubectl apply -f .\httpbin-gateway.yaml
kubectl apply -f .\httpbin.yaml
If all goes well, you will be able to do load httpbin page.
To apply the local rate restriction to all route, use the following yaml (ripped off from isio docs)
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: filter-local-ratelimit-svc
namespace: default
spec:
workloadSelector:
labels:
app: httpbin
configPatches:
- applyTo: HTTP_FILTER
match:
context: SIDECAR_INBOUND
listener:
filterChain:
filter:
name: "envoy.filters.network.http_connection_manager"
patch:
operation: INSERT_BEFORE
value:
name: envoy.filters.http.local_ratelimit
typed_config:
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
type_url: type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
value:
stat_prefix: http_local_rate_limiter
token_bucket:
max_tokens: 4
tokens_per_fill: 4
fill_interval: 60s
filter_enabled:
runtime_key: local_rate_limit_enabled
default_value:
numerator: 100
denominator: HUNDRED
filter_enforced:
runtime_key: local_rate_limit_enforced
default_value:
numerator: 100
denominator: HUNDRED
response_headers_to_add:
- append: false
header:
key: x-local-rate-limit
value: 'true'
Enforcing it to specific route
To enforce local rate limiting to specific route (The port number specified should be the service)
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: filter-local-ratelimit-svc-local
namespace: default
spec:
workloadSelector:
labels:
app: httpbin
configPatches:
- applyTo: HTTP_FILTER
match:
context: SIDECAR_INBOUND
listener:
filterChain:
filter:
name: "envoy.filters.network.http_connection_manager"
patch:
operation: INSERT_BEFORE
value:
name: envoy.filters.http.local_ratelimit
typed_config:
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
type_url: type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
value:
stat_prefix: http_local_rate_limiter
- applyTo: HTTP_ROUTE
match:
context: SIDECAR_INBOUND
routeConfiguration:
vhost:
name: "inbound|http|8000" # 8000 for service
route:
action: ANY
patch:
operation: MERGE
value:
typed_per_filter_config:
envoy.filters.http.local_ratelimit:
"@type": type.googleapis.com/udpa.type.v1.TypedStruct
type_url: type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
value:
stat_prefix: http_local_rate_limiter
token_bucket:
max_tokens: 4
tokens_per_fill: 4
fill_interval: 60s
filter_enabled:
runtime_key: local_rate_limit_enabled
default_value:
numerator: 100
denominator: HUNDRED
filter_enforced:
runtime_key: local_rate_limit_enforced
default_value:
numerator: 100
denominator: HUNDRED
response_headers_to_add:
- append: false
header:
key: x-local-rate-limit
value: 'true'
You can get the vhost name via istioctl command for example,
istioctl proxy-config routes httpbin-6fcb98998c-7rxzf
It has to be inbound.
In the applyTo configuration there are a couple of the options that you can choose such as LISTENER, FILTER_CHAIN. We are using HTT_ROUTE which allows us to specify vhost name to choose what traffic the rate limiting gets applied to.
Important configuration notes
workloadSelector - refers to POD and ensure the label matches those of the pods and not service.
applyTo: HTTP_ROUTE - Under the vhost name you can specify a port and that port refers to the service port.
namespace - could be your application namespace. This helps with management and also enforce rate limiting to the workload in the specified namespace.
In our case, rate limiting only applies to pod in default namespace.
For routeConfigration schema, please refer to this link
here.https://istio.io/latest/docs/reference/config/networking/envoy-filter/#EnvoyFilter-RouteConfigurationMatch
Comments