Alibaba Cloud Service Mesh:Configure local rate limiting for services

Step 1: Create a local rate limiting rule

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of your ASM instance. In the left-side navigation pane, choose Traffic Management Center > Rate Limiting.

3. Click Create and configure the following parameters:

   Section	Parameter	Value
   Basic Information About Throttling	Namespace	Select default.
   	Name	Enter httpbin.
   	Type of Effective Workload	Select Applicable Application.
   	Relevant Workload	Set Key to app and Value to httpbin.
   List of Throttling Rules	Service Port	Enter 8000 (the HTTP port declared in the HTTPBin Kubernetes Service).
   	Throttling Configuration	Set Time Window for Throttling Detection to 60 seconds and Number of Requests Allowed in Time Window to 10.

4. Click OK.

   

apiVersion: istio.alibabacloud.com/v1beta1
kind: ASMLocalRateLimiter
metadata:
  name: httpbin
  namespace: default
spec:
  workloadSelector:
    labels:
      app: httpbin            # Target pods with this label
  isGateway: false            # Apply to sidecar proxies, not gateways
  configs:
    - match:
        vhost:
          name: '*'           # Match all virtual hosts
          port: 8000          # Target port 8000
          route:
            header_match:
              - name: ':path'
                prefix_match: /       # Match all paths
                invert_match: false
      limit:
        fill_interval:
          seconds: 60         # Token refill interval
        quota: 10             # Tokens available per interval (max requests)

Step 2: Verify the rate limit

1. Open a shell in the sleep pod:

      kubectl exec -it deploy/sleep -- sh

2. Send 10 requests to exhaust the token bucket:

      for i in $(seq 1 10); do curl -v http://httpbin:8000/headers; done

3. Send one more request:

      curl -v http://httpbin:8000/headers

   Expected output:

      *   Trying 172.16.245.130:8000...
      * Connected to httpbin (172.16.245.130) port 8000
      > GET /headers HTTP/1.1
      > Host: httpbin:8000
      > User-Agent: curl/8.5.0
      > Accept: */*
      >
      < HTTP/1.1 429 Too Many Requests
      < x-local-rate-limit: true
      < content-length: 18
      < content-type: text/plain
      < date: Tue, 26 Dec 2023 08:02:58 GMT
      < server: envoy
      < x-envoy-upstream-service-time: 2

   The 429 Too Many Requests response with the x-local-rate-limit: true header confirms that local rate limiting is active.

Step 1: Create a local rate limiting rule

1. Log on to the ASM console. In the left-side navigation pane, choose Service Mesh > Mesh Management.

2. On the Mesh Management page, click the name of your ASM instance. In the left-side navigation pane, choose Traffic Management Center > Rate Limiting.

3. Click Create and configure the following parameters:

   Section	Parameter	Value
   Basic Information About Throttling	Namespace	Select default.
   	Name	Enter httpbin.
   	Type of Effective Workload	Select Applicable Application.
   	Relevant Workload	Set Key to app and Value to httpbin.
   List of Throttling Rules	Service Port	Enter 8000.
   	Match Request Attributes	Set Matched Attributes to Request Path, Matching Method to Prefix Match, and Matched Content to /headers.
   	Throttling Configuration	Set Time Window for Throttling Detection to 60 seconds and Number of Requests Allowed in Time Window to 10.

4. Click OK.

   

Step 2: Verify the rate limit

1. Open a shell in the sleep pod:

      kubectl exec -it deploy/sleep -- sh

2. Send 10 requests to the /headers path to exhaust the token bucket:

      for i in $(seq 1 10); do curl -v http://httpbin:8000/headers; done

3. Send one more request to /headers:

      curl -v http://httpbin:8000/headers

   Expected output:

      *   Trying 172.16.245.130:8000...
      * Connected to httpbin (172.16.245.130) port 8000
      > GET /headers HTTP/1.1
      > Host: httpbin:8000
      > User-Agent: curl/8.5.0
      > Accept: */*
      >
      < HTTP/1.1 429 Too Many Requests
      < x-local-rate-limit: true
      < content-length: 18
      < content-type: text/plain
      < date: Tue, 26 Dec 2023 08:02:58 GMT
      < server: envoy
      < x-envoy-upstream-service-time: 2

   The 429 response confirms that requests to /headers are rate limited.

4. Send a request to a different path to confirm it is unaffected:

      curl -v http://httpbin:8000/get

   Expected output:

      *   Trying 192.168.243.21:8000...
      * Connected to httpbin (192.168.243.21) port 8000 (#0)
      > GET /get HTTP/1.1
      > Host: httpbin:8000
      > User-Agent: curl/8.1.2
      > Accept: */*
      >
      < HTTP/1.1 200 OK
      < server: envoy
      < date: Thu, 11 Jan 2024 03:46:11 GMT
      < content-type: application/json
      < content-length: 431
      < access-control-allow-origin: *
      < access-control-allow-credentials: true
      < x-envoy-upstream-service-time: 1
      <
      {
        "args": {},
        "headers": {
          "Accept": "*/*",
          "Host": "httpbin:8000",
          "User-Agent": "curl/8.1.2",
          "X-Envoy-Attempt-Count": "1",
          "X-Forwarded-Client-Cert": "By=spiffe://cluster.local/ns/default/sa/httpbin;Hash=be10819991ba1a354a89e68b3bed1553c12a4fba8b65fbe0f16299d552680b29;Subject=\"\";URI=spiffe://cluster.local/ns/default/sa/sleep"
        },
        "origin": "127.0.0.6",
        "url": "http://httpbin:8000/get"
      }

   The 200 OK response confirms that requests to other paths are not subject to the rate limiting rule.

Why does my local rate limiting rule not take effect?

The service does not use HTTP: Local rate limiting works only with HTTP and HTTP-based protocols (gRPC, dubbo3). Verify that your service uses a supported protocol and that the protocol is declared correctly in the Kubernetes Service definition. For guidance, see How do I specify the protocol of a service in a standard manner?

A Sidecar CRD overrides inbound traffic configuration: ASM automatically configures an inbound traffic listener for sidecar proxies based on the service declaration. Local rate limiting rules depend on this default configuration.

If you used a Sidecar CRD to modify the default inbound traffic configuration (for example, to expose a localhost application to other pods), the inbound port may differ from the service port. In this case, set the rate limiting rule to use the port defined in the Sidecar CRD instead of the original service port.

For example, if the following Sidecar CRD maps inbound traffic to port 80:

apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: localhost-access
  namespace: default
spec:
  ingress:
    - defaultEndpoint: '127.0.0.1:80'
      port:
        name: http
        number: 80
        protocol: HTTP
  workloadSelector:
    labels:
      app: httpbin

Set the service port in your rate limiting rule to 80 instead of 8000.