Alibaba Cloud Service Mesh:ASMLocalRateLimiter CRD fields

How it works

ASMLocalRateLimiter uses a token bucket algorithm to control request rates:

1. Each Envoy proxy maintains a token bucket with a configured number of tokens (quota).

2. Tokens are replenished at a regular interval (fill_interval).

3. If no tokens are available, the request is rejected with HTTP status 429 (configurable).

By default, all worker threads within a single Envoy process share one token bucket. Set per_downstream_connection to true to allocate a separate bucket per connection.

CRD structure overview

This skeleton shows how fields nest within the CRD:

apiVersion: istio.alibabacloud.com/v1beta1   # or v1
kind: ASMLocalRateLimiter
metadata:
  name: <rule-name>
  namespace: <namespace>
spec:
  workloadSelector:
    labels:
      <label-key>: <label-value>
  isGateway: true | false
  configs:
    - name: <config-name>
      match:
        vhost:
          name: <virtual-host-name>
          port: <port>
          route:
            name_match: <route-name>
      limit:
        status: <http-status-code>
        fill_interval:
          seconds: <int>
          nanos: <int>
        quota: <int>
        per_downstream_connection: true | false
        custom_response_body: <string>
        response_header_to_add:
          <header-name>: <header-value>
      limit_overrides:
        - request_match:
            header_match:
              - name: <header-name>
                exact_match: <value>
            query_match:
              - name: <param-name>
                exact_match: <value>
          limit:
            fill_interval:
              seconds: <int>
            quota: <int>

Configuration example

The following example applies rate limiting to an ingress gateway. Two virtual hosts receive different limits: www.example1.com at 10 requests per second, and www.example2.com at 100 requests per second.

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMLocalRateLimiter
metadata:
  name: for-api-test
  namespace: default
spec:
  workloadSelector:
    labels:
      app: istio-ingressgateway
  isGateway: true
  configs:
    - match:
        vhost:
          name: "www.example1.com" # If multiple vhosts are configured on the gateway, enter the name of the last vhost.
          port: 80
          route:
            name_match: "test1" # The name of the route that is configured for the virtual service. If the virtual service does not have the specified route, the rate limiting does not take effect.
      limit:
         fill_interval:
            seconds: 1
         quota: 10
    - match:
        vhost:
          name: "www.example2.com"
          port: 80
          route:
            name_match: "test1"
      limit:
         fill_interval:
            seconds: 1
         quota: 100

Supported apiVersion values

If you previously set the apiVersion to istio.alibabacloud.com/v1beta1 for ASMCircuitBreaker in a Container Service for Kubernetes (ACK) cluster, change the value to istio.alibabacloud.com/v1 and redeploy the cluster.

spec

For more information, see Configure local rate limiting on an ingress gateway.

LocalRateLimiterConfig

RatelimitMatch

LimitConfig

RateLimitOverrideConfig

Use overrides to apply a different rate limit to requests that match specific headers or query parameters, while keeping the base rate limit for all other traffic.

VirtualHostMatch

RouteMatch

RequestMatcher

When both header_match and query_match are specified, a request must satisfy all conditions to be matched.

HeaderMatcher

Specify exactly one match mode field (regex_match, exact_match, prefix_match, suffix_match, or present_match) per matcher.

QueryParameterMatcher

Specify exactly one match mode field (exact_match, prefix_match, suffix_match, regex_match, contains_match, or present_match) per matcher.