In this setup, we are going to use httpbin in the istio samples folder. The steps is to
1. deploy httpbin
2. enforce local rate limit
3. test
Local rate limit means it applied to workloads. In this context, we are deploy to istio-system, which means it gets applied to all workload in all namespace.
Let's deploy the httpbin. It is pretty plain. I didn't deploy any config map that specified in istio documentation.
apiVersion: v1
kind: ServiceAccount
metadata:
name: httpbin
---
apiVersion: v1
kind: Service
metadata:
name: httpbin
labels:
app: httpbin
service: httpbin
spec:
ports:
- name: http
port: 8000
targetPort: 80
selector:
app: httpbin
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: httpbin
spec:
replicas: 1
selector:
matchLabels:
app: httpbin
version: v1
template:
metadata:
labels:
app: httpbin
version: v1
spec:
serviceAccountName: httpbin
containers:
- image: docker.io/kennethreitz/httpbin
imagePullPolicy: IfNotPresent
name: httpbin
ports:
- containerPort: 80
Let's deploy the rate limit. Please note that i deployed the rate limit to istio-system namespace. You can deploy envoyfilter scoped to your namespace. It will still work.
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: httpbin-ratelimit
namespace: istio-system
spec:
workloadSelector:
labels:
app: httpbin
version: v1
configPatches:
- applyTo: HTTP_FILTER
match:
context: SIDECAR_INBOUND
listener:
filterChain:
filter:
name: 'envoy.filters.network.http_connection_manager'
patch:
operation: INSERT_BEFORE
value:
name: envoy.filters.http.local_ratelimit
typed_config:
'@type': type.googleapis.com/udpa.type.v1.TypedStruct
type_url: type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
value:
stat_prefix: http_local_rate_limiter
enable_x_ratelimit_headers: DRAFT_VERSION_03
token_bucket:
max_tokens: 5
tokens_per_fill: 5
fill_interval: 120s
filter_enabled:
runtime_key: local_rate_limit_enabled
default_value:
numerator: 100
denominator: HUNDRED
filter_enforced:
runtime_key: local_rate_limit_enforced
default_value:
numerator: 100
denominator: HUNDRED
Here we are limiting to 5 requests over 2 minutes.
Once you have deployed that, you can verify that too by running (replace with your httpbin pod)
istioctl pc listeners httpbin-5767759747-vrzsx -o json
You can verify that the rate limit has been applied to the pod. You can hit the service and after 5 requested (mine actually came after i made more than 5 requests) - you will get a local-rate-limit.
You can configure by referring to this documentation here.
https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/local_rate_limit_filter
Comments