Alibaba Cloud Service Mesh:Description of ASMGlobalRateLimiter CRD

Limit inbound requests to a service (server-side)

This configuration limits the httpbin application to 1 request per minute across all clients. Because applyToTraffic is set to sidecar_inbound, the rate limit is enforced at the server side regardless of which client sends the request.

apiVersion: istio.alibabacloud.com/v1
kind: ASMGlobalRateLimiter
metadata:
  name: global-test
spec:
  configs:
  - limit:
      quota: 1
      unit: MINUTE
    target_services:
    - name: httpbin
      port: 8000
    name: default
  applyToTraffic: sidecar_inbound
  rateLimitService:
    host: ratelimit.default.svc.cluster.local # Queries this service to determine whether the current request needs to be throttled.
    port: 8081
    timeout:
      seconds: 5
  workloadSelector:
    labels:
      app: httpbin

Limit outbound requests from a client (client-side)

This configuration limits the sleep application to 1 request per minute when calling the httpbin service. Because applyToTraffic is set to sidecar_outbound, only this specific client is rate-limited. Other clients that call httpbin are not affected.

apiVersion: istio.alibabacloud.com/v1
kind: ASMGlobalRateLimiter
metadata:
  name: global-test
spec:
  configs:
  - limit:
      quota: 1
      unit: MINUTE
    target_services:
    - name: httpbin
      port: 8000
    name: default
  applyToTraffic: sidecar_outbound
  rateLimitService:
    host: ratelimit.default.svc.cluster.local # Queries this service to determine whether the current request needs to be throttled.
    port: 8081
    timeout:
      seconds: 5
  workloadSelector:
    labels:
      app: sleep

Rate limit by request header on a waypoint (Ambient mode)

This example applies only to Ambient mode and requires an ASM instance of version 1.25.6.74 or later.

This configuration attaches a rate limiting rule to the default waypoint. Requests that include the x-user header get a per-user bucket limited to 1 request per minute (distinct: true). Requests without the header share a common bucket limited to 20 requests per minute.

apiVersion: istio.alibabacloud.com/v1
kind: ASMGlobalRateLimiter
metadata:
  name: global-test
spec:
  configs:
  - limit_overrides:
    - limit:
        quota: 1
        unit: MINUTE
      request_match:
        header_match:
        - distinct: true
          name: x-user
    limit:
      quota: 20
      unit: MINUTE
    target_services:
    - name: httpbin
      port: 8000
    name: default
  applyToTraffic: waypoint
  rateLimitService:
    host: ratelimit.default.svc.cluster.local # Queries this service to determine whether the current request needs to be throttled.
    port: 8081
    timeout:
      seconds: 5
  workloadSelector:
    labels:
      gateway.networking.k8s.io/gateway-name: default

applyToTraffic values

TargetServiceRef examples

target_services:
- kind: Service
  namespace: default
  name: httpbin
  port: 8000

apiVersion: networking.istio.io/v1
kind: ServiceEntry
metadata:
  name: se-httpbin-external
spec:
  hosts:
  - httpbin.test.com
  location: MESH_EXTERNAL
  ports:
  - name: http
    number: 80
    protocol: HTTP
  - name: https
    number: 443
    protocol: HTTPS
  resolution: DNS

target_services:
- kind: ServiceEntry
  namespace: default
  name: se-httpbin-external
  port: 80

apiVersion: networking.istio.io/v1
kind: VirtualService
metadata:
  name: vs-httpbin
spec:
  hosts:
  - httpbin.test.com
  http:
  - name: default
    route:
    - destination:
        host: httpbin
        port:
          number: 8000

target_services:
- kind: VirtualService
  namespace: default
  name: vs-httpbin
  section_name: default