Skip to content

Commit 5cb3b15

Browse files
kkk777-7kkk777-7
committed
feat: support both rate limit in xds translator
Signed-off-by: kkk777-7 <[email protected]>
1 parent 4c2619d commit 5cb3b15

File tree

17 files changed

+122
-91
lines changed

17 files changed

+122
-91
lines changed

‎api/v1alpha1/ratelimit_types.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ type RateLimitSpec struct {
1010
// Type decides the scope for the RateLimits.
1111
// Valid RateLimitType values are "Global" or "Local".
1212
//
13-
// Deprecated: Use Type. allow both "Global" and "Local" fields now.
13+
// Deprecated: Use Global and/or Local fields directly instead. Both can be specified simultaneously for combined rate limiting.
1414
//
1515
// +optional
1616
Type *RateLimitType `json:"type"`

‎charts/gateway-crds-helm/templates/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1388,7 +1388,7 @@ spec:
13881388
Type decides the scope for the RateLimits.
13891389
Valid RateLimitType values are "Global" or "Local".
13901390
1391-
Deprecated: Use Type. allow both "Global" and "Local" fields now.
1391+
Deprecated: Use Global and/or Local fields directly instead. Both can be specified simultaneously for combined rate limiting.
13921392
enum:
13931393
- Global
13941394
- Local

‎charts/gateway-helm/crds/generated/gateway.envoyproxy.io_backendtrafficpolicies.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1387,7 +1387,7 @@ spec:
13871387
Type decides the scope for the RateLimits.
13881388
Valid RateLimitType values are "Global" or "Local".
13891389
1390-
Deprecated: Use Type. allow both "Global" and "Local" fields now.
1390+
Deprecated: Use Global and/or Local fields directly instead. Both can be specified simultaneously for combined rate limiting.
13911391
enum:
13921392
- Global
13931393
- Local

‎internal/xds/translator/local_ratelimit.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -213,7 +213,7 @@ func buildRouteLocalRateLimits(local *ir.LocalRateLimit) (
213213

214214
if match.Distinct {
215215
// For distinct matches, we only check if the header exists using the RequestHeaders action.
216-
descriptorKey := getRouteRuleDescriptor(rIdx, mIdx)
216+
descriptorKey := fmt.Sprintf("local_%s", getRouteRuleDescriptor(rIdx, mIdx))
217217
action = &routev3.RateLimit_Action{
218218
ActionSpecifier: &routev3.RateLimit_Action_RequestHeaders_{
219219
RequestHeaders: &routev3.RateLimit_Action_RequestHeaders{
@@ -230,8 +230,8 @@ func buildRouteLocalRateLimits(local *ir.LocalRateLimit) (
230230
} else {
231231
// For exact matches, we check if there is an existing header with the matching value using the
232232
// HeaderValueMatch action.
233-
descriptorKey := getRouteRuleDescriptor(rIdx, mIdx)
234-
descriptorVal := getRouteRuleDescriptor(rIdx, mIdx)
233+
descriptorKey := fmt.Sprintf("local_%s", getRouteRuleDescriptor(rIdx, mIdx))
234+
descriptorVal := fmt.Sprintf("local_%s", getRouteRuleDescriptor(rIdx, mIdx))
235235
headerMatcher := &routev3.HeaderMatcher{
236236
Name: match.Name,
237237
HeaderMatchSpecifier: &routev3.HeaderMatcher_StringMatch{
@@ -281,7 +281,7 @@ func buildRouteLocalRateLimits(local *ir.LocalRateLimit) (
281281
},
282282
}
283283
entry := &rlv3.RateLimitDescriptor_Entry{
284-
Key: descriptorMaskedRemoteAddress,
284+
Key: fmt.Sprintf("local_%s", descriptorMaskedRemoteAddress),
285285
Value: rule.CIDRMatch.CIDR,
286286
}
287287
descriptorEntries = append(descriptorEntries, entry)
@@ -298,7 +298,7 @@ func buildRouteLocalRateLimits(local *ir.LocalRateLimit) (
298298
// If the CIDRMatch is distinct, we use the built-in remote address descriptor key without a value.
299299
// This means that each distinct client IP will be counted separately.
300300
entry = &rlv3.RateLimitDescriptor_Entry{
301-
Key: descriptorRemoteAddress,
301+
Key: fmt.Sprintf("local_%s", descriptorRemoteAddress),
302302
}
303303
descriptorEntries = append(descriptorEntries, entry)
304304
rlActions = append(rlActions, action)

‎internal/xds/translator/ratelimit.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -171,7 +171,7 @@ func patchRouteWithRateLimit(route *routev3.Route, irRoute *ir.HTTPRoute) error
171171
if costSpecified {
172172
return patchRouteWithRateLimitOnTypedFilterConfig(route, rateLimits, irRoute)
173173
}
174-
xdsRouteAction.RateLimits = rateLimits
174+
xdsRouteAction.RateLimits = append(xdsRouteAction.RateLimits, rateLimits...)
175175
return nil
176176
}
177177

‎internal/xds/translator/testdata/out/xds-ir/local-ratelimit-distinct.routes.yaml‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
rateLimits:
1414
- actions:
1515
- requestHeaders:
16-
descriptorKey: rule-0-match-0
16+
descriptorKey: local_rule-0-match-0
1717
headerName: x-user-id
1818
upgradeConfigs:
1919
- upgradeType: websocket
@@ -23,7 +23,7 @@
2323
alwaysConsumeDefaultTokenBucket: false
2424
descriptors:
2525
- entries:
26-
- key: rule-0-match-0
26+
- key: local_rule-0-match-0
2727
tokenBucket:
2828
fillInterval: 0s
2929
maxTokens: 5
@@ -48,33 +48,33 @@
4848
rateLimits:
4949
- actions:
5050
- headerValueMatch:
51-
descriptorKey: rule-0-match-0
52-
descriptorValue: rule-0-match-0
51+
descriptorKey: local_rule-0-match-0
52+
descriptorValue: local_rule-0-match-0
5353
expectMatch: true
5454
headers:
5555
- name: x-user-id
5656
stringMatch:
5757
exact: one
5858
- headerValueMatch:
59-
descriptorKey: rule-0-match-1
60-
descriptorValue: rule-0-match-1
59+
descriptorKey: local_rule-0-match-1
60+
descriptorValue: local_rule-0-match-1
6161
expectMatch: true
6262
headers:
6363
- name: x-org-id
6464
stringMatch:
6565
exact: foo
6666
- actions:
6767
- headerValueMatch:
68-
descriptorKey: rule-1-match-0
69-
descriptorValue: rule-1-match-0
68+
descriptorKey: local_rule-1-match-0
69+
descriptorValue: local_rule-1-match-0
7070
expectMatch: true
7171
headers:
7272
- name: x-user-id
7373
stringMatch:
7474
exact: two
7575
- headerValueMatch:
76-
descriptorKey: rule-1-match-1
77-
descriptorValue: rule-1-match-1
76+
descriptorKey: local_rule-1-match-1
77+
descriptorValue: local_rule-1-match-1
7878
expectMatch: true
7979
headers:
8080
- name: x-org-id
@@ -91,22 +91,22 @@
9191
alwaysConsumeDefaultTokenBucket: false
9292
descriptors:
9393
- entries:
94-
- key: rule-0-match-0
95-
value: rule-0-match-0
96-
- key: rule-0-match-1
97-
value: rule-0-match-1
94+
- key: local_rule-0-match-0
95+
value: local_rule-0-match-0
96+
- key: local_rule-0-match-1
97+
value: local_rule-0-match-1
9898
tokenBucket:
9999
fillInterval: 3600s
100100
maxTokens: 10
101101
tokensPerFill: 10
102102
- entries:
103-
- key: rule-1-match-0
104-
value: rule-1-match-0
105-
- key: rule-1-match-1
106-
value: rule-1-match-1
107-
- key: masked_remote_address
103+
- key: local_rule-1-match-0
104+
value: local_rule-1-match-0
105+
- key: local_rule-1-match-1
106+
value: local_rule-1-match-1
107+
- key: local_masked_remote_address
108108
value: 192.168.0.0/16
109-
- key: remote_address
109+
- key: local_remote_address
110110
tokenBucket:
111111
fillInterval: 60s
112112
maxTokens: 10

‎internal/xds/translator/testdata/out/xds-ir/local-ratelimit.routes.yaml‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -13,16 +13,16 @@
1313
rateLimits:
1414
- actions:
1515
- headerValueMatch:
16-
descriptorKey: rule-0-match-0
17-
descriptorValue: rule-0-match-0
16+
descriptorKey: local_rule-0-match-0
17+
descriptorValue: local_rule-0-match-0
1818
expectMatch: true
1919
headers:
2020
- name: x-user-id
2121
stringMatch:
2222
exact: one
2323
- headerValueMatch:
24-
descriptorKey: rule-0-match-1
25-
descriptorValue: rule-0-match-1
24+
descriptorKey: local_rule-0-match-1
25+
descriptorValue: local_rule-0-match-1
2626
expectMatch: true
2727
headers:
2828
- name: x-org-id
@@ -36,10 +36,10 @@
3636
alwaysConsumeDefaultTokenBucket: false
3737
descriptors:
3838
- entries:
39-
- key: rule-0-match-0
40-
value: rule-0-match-0
41-
- key: rule-0-match-1
42-
value: rule-0-match-1
39+
- key: local_rule-0-match-0
40+
value: local_rule-0-match-0
41+
- key: local_rule-0-match-1
42+
value: local_rule-0-match-1
4343
tokenBucket:
4444
fillInterval: 3600s
4545
maxTokens: 10
@@ -64,33 +64,33 @@
6464
rateLimits:
6565
- actions:
6666
- headerValueMatch:
67-
descriptorKey: rule-0-match-0
68-
descriptorValue: rule-0-match-0
67+
descriptorKey: local_rule-0-match-0
68+
descriptorValue: local_rule-0-match-0
6969
expectMatch: true
7070
headers:
7171
- name: x-user-id
7272
stringMatch:
7373
exact: one
7474
- headerValueMatch:
75-
descriptorKey: rule-0-match-1
76-
descriptorValue: rule-0-match-1
75+
descriptorKey: local_rule-0-match-1
76+
descriptorValue: local_rule-0-match-1
7777
expectMatch: true
7878
headers:
7979
- name: x-org-id
8080
stringMatch:
8181
exact: foo
8282
- actions:
8383
- headerValueMatch:
84-
descriptorKey: rule-1-match-0
85-
descriptorValue: rule-1-match-0
84+
descriptorKey: local_rule-1-match-0
85+
descriptorValue: local_rule-1-match-0
8686
expectMatch: true
8787
headers:
8888
- name: x-user-id
8989
stringMatch:
9090
exact: two
9191
- headerValueMatch:
92-
descriptorKey: rule-1-match-1
93-
descriptorValue: rule-1-match-1
92+
descriptorKey: local_rule-1-match-1
93+
descriptorValue: local_rule-1-match-1
9494
expectMatch: true
9595
headers:
9696
- name: x-org-id
@@ -106,20 +106,20 @@
106106
alwaysConsumeDefaultTokenBucket: false
107107
descriptors:
108108
- entries:
109-
- key: rule-0-match-0
110-
value: rule-0-match-0
111-
- key: rule-0-match-1
112-
value: rule-0-match-1
109+
- key: local_rule-0-match-0
110+
value: local_rule-0-match-0
111+
- key: local_rule-0-match-1
112+
value: local_rule-0-match-1
113113
tokenBucket:
114114
fillInterval: 3600s
115115
maxTokens: 10
116116
tokensPerFill: 10
117117
- entries:
118-
- key: rule-1-match-0
119-
value: rule-1-match-0
120-
- key: rule-1-match-1
121-
value: rule-1-match-1
122-
- key: masked_remote_address
118+
- key: local_rule-1-match-0
119+
value: local_rule-1-match-0
120+
- key: local_rule-1-match-1
121+
value: local_rule-1-match-1
122+
- key: local_masked_remote_address
123123
value: 192.168.0.0/16
124124
tokenBucket:
125125
fillInterval: 60s

‎internal/xds/translator/testdata/out/xds-ir/ratelimit-both-type.routes.yaml‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,15 @@
3131
route:
3232
cluster: second-route-dest
3333
rateLimits:
34+
- actions:
35+
- headerValueMatch:
36+
descriptorKey: local_rule-0-match-0
37+
descriptorValue: local_rule-0-match-0
38+
expectMatch: true
39+
headers:
40+
- name: x-user-id
41+
stringMatch:
42+
exact: one
3443
- actions:
3544
- genericKey:
3645
descriptorKey: second-route
@@ -46,8 +55,8 @@
4655
alwaysConsumeDefaultTokenBucket: false
4756
descriptors:
4857
- entries:
49-
- key: rule-0-match-0
50-
value: rule-0-match-0
58+
- key: local_rule-0-match-0
59+
value: local_rule-0-match-0
5160
tokenBucket:
5261
fillInterval: 3600s
5362
maxTokens: 10

‎release-notes/current.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ new features: |
2626
Added support for returning 503 responses when no valid backend endpoints exist.
2727
Added support for CSRFTokenTTL in OIDC authn to configure the lifetime of the CSRF token used during the OAuth2 authorization code flow.
2828
Added support for binaryData in ConfigMap referenced by HTTPRouteFilter for direct response.
29+
Added support for both Global and Local rate limiting in BackendTrafficPolicy simultaneously.
2930
3031
3132
bug fixes: |

‎site/content/en/latest/api/extension_types.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4262,7 +4262,7 @@ _Appears in:_
42624262

42634263
| Field | Type | Required | Default | Description |
42644264
| --- | --- | --- | --- | --- |
4265-
| `type` | _[RateLimitType](#ratelimittype)_ | false | | Type decides the scope for the RateLimits.<br />Valid RateLimitType values are "Global" or "Local".<br />Deprecated: Use Type. allow both "Global" and "Local" fields now. |
4265+
| `type` | _[RateLimitType](#ratelimittype)_ | false | | Type decides the scope for the RateLimits.<br />Valid RateLimitType values are "Global" or "Local".<br />Deprecated: Use Global and/or Local fields directly instead. Both can be specified simultaneously for combined rate limiting. |
42664266
| `global` | _[GlobalRateLimit](#globalratelimit)_ | false | | Global defines global rate limit configuration. |
42674267
| `local` | _[LocalRateLimit](#localratelimit)_ | false | | Local defines local rate limit configuration. |
42684268

0 commit comments

Comments
 (0)