Skip to content

bug: disable x-envoy-ratelimited by default #7110

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zirain merged 3 commits into from
Oct 2, 2025
Merged

bug: disable x-envoy-ratelimited by default #7110

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
922ac1b
bug: disable x-envoy-ratelimited by default
Sep 30, 2025
a97c4f8
fix tests and release note
Oct 1, 2025
08750af
fix testdata
Oct 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions internal/cmd/egctl/testdata/translate/out/envoy-patch-policy.all.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,6 +189,7 @@ xds:
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
domain: eag-ratelimit
disableXEnvoyRatelimitedHeader: true
failureModeDeny: true
rateLimitService:
grpcService:
Expand Down
6 changes: 6 additions & 0 deletions internal/xds/translator/ratelimit.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,6 +126,12 @@ func createRateLimitFilter(t *Translator, irListener *ir.HTTPListener, domain, f
rateLimitFilterProto.Timeout = durationpb.New(t.GlobalRateLimit.Timeout)
}

// Disable the x-envoy-ratelimited header unless envoy headers are explicitly enabled.
rateLimitFilterProto.DisableXEnvoyRatelimitedHeader = true
if irListener.Headers != nil && irListener.Headers.EnableEnvoyHeaders {
rateLimitFilterProto.DisableXEnvoyRatelimitedHeader = false
}

// Configure the X-RateLimit headers based on the listener's header settings
if irListener.Headers != nil && irListener.Headers.DisableRateLimitHeaders {
rateLimitFilterProto.EnableXRatelimitHeaders = ratelimitfilterv3.RateLimit_OFF
Expand Down
1 change: 1 addition & 0 deletions internal/xds/translator/testdata/out/xds-ir/jsonpatch-add-op-without-value.listeners.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
domain: eg-ratelimit
disableXEnvoyRatelimitedHeader: true
failureModeDeny: true
rateLimitService:
grpcService:
Expand Down
1 change: 1 addition & 0 deletions internal/xds/translator/testdata/out/xds-ir/jsonpatch-move-op-with-value.listeners.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
domain: eg-ratelimit
disableXEnvoyRatelimitedHeader: true
failureModeDeny: true
rateLimitService:
grpcService:
Expand Down
1 change: 1 addition & 0 deletions internal/xds/translator/testdata/out/xds-ir/jwt-ratelimit.listeners.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@
- name: envoy.filters.http.ratelimit
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
disableXEnvoyRatelimitedHeader: true
domain: first-listener
enableXRatelimitHeaders: DRAFT_VERSION_03
rateLimitService:
Expand Down
1 change: 1 addition & 0 deletions internal/xds/translator/testdata/out/xds-ir/ratelimit-custom-domain.listeners.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
- name: envoy.filters.http.ratelimit
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
disableXEnvoyRatelimitedHeader: true
domain: first-listener
enableXRatelimitHeaders: DRAFT_VERSION_03
rateLimitService:
Expand Down
1 change: 1 addition & 0 deletions internal/xds/translator/testdata/out/xds-ir/ratelimit-disable-headers.listeners.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
- name: envoy.filters.http.ratelimit
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
disableXEnvoyRatelimitedHeader: true
domain: first-listener
rateLimitService:
grpcService:
Expand Down
1 change: 1 addition & 0 deletions internal/xds/translator/testdata/out/xds-ir/ratelimit-endpoint-stats.listeners.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
- name: envoy.filters.http.ratelimit
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
disableXEnvoyRatelimitedHeader: true
domain: first-listener
enableXRatelimitHeaders: DRAFT_VERSION_03
rateLimitService:
Expand Down
3 changes: 3 additions & 0 deletions internal/xds/translator/testdata/out/xds-ir/ratelimit-global-shared.listeners.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
- name: envoy.filters.http.ratelimit
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
disableXEnvoyRatelimitedHeader: true
domain: first-listener
enableXRatelimitHeaders: DRAFT_VERSION_03
rateLimitService:
Expand All @@ -27,6 +28,7 @@
- name: envoy.filters.http.ratelimit/test-namespace/test-policy-1
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
disableXEnvoyRatelimitedHeader: true
domain: test-namespace/test-policy-1
enableXRatelimitHeaders: DRAFT_VERSION_03
rateLimitService:
Expand All @@ -37,6 +39,7 @@
- name: envoy.filters.http.ratelimit/test-namespace/test-policy-2
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
disableXEnvoyRatelimitedHeader: true
domain: test-namespace/test-policy-2
enableXRatelimitHeaders: DRAFT_VERSION_03
rateLimitService:
Expand Down
1 change: 1 addition & 0 deletions internal/xds/translator/testdata/out/xds-ir/ratelimit-headers-and-cidr.listeners.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
- name: envoy.filters.http.ratelimit
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
disableXEnvoyRatelimitedHeader: true
domain: first-listener
enableXRatelimitHeaders: DRAFT_VERSION_03
rateLimitService:
Expand Down
3 changes: 3 additions & 0 deletions internal/xds/translator/testdata/out/xds-ir/ratelimit-multi-global-shared.listeners.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
- name: envoy.filters.http.ratelimit
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
disableXEnvoyRatelimitedHeader: true
domain: first-listener
enableXRatelimitHeaders: DRAFT_VERSION_03
rateLimitService:
Expand All @@ -27,6 +28,7 @@
- name: envoy.filters.http.ratelimit/test-namespace/test-policy-1
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
disableXEnvoyRatelimitedHeader: true
domain: test-namespace/test-policy-1
enableXRatelimitHeaders: DRAFT_VERSION_03
rateLimitService:
Expand All @@ -37,6 +39,7 @@
- name: envoy.filters.http.ratelimit/test-namespace/test-policy-2
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
disableXEnvoyRatelimitedHeader: true
domain: test-namespace/test-policy-2
enableXRatelimitHeaders: DRAFT_VERSION_03
rateLimitService:
Expand Down
1 change: 1 addition & 0 deletions internal/xds/translator/testdata/out/xds-ir/ratelimit-sourceip.listeners.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
- name: envoy.filters.http.ratelimit
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
disableXEnvoyRatelimitedHeader: true
domain: first-listener
enableXRatelimitHeaders: DRAFT_VERSION_03
rateLimitService:
Expand Down
1 change: 1 addition & 0 deletions internal/xds/translator/testdata/out/xds-ir/ratelimit.listeners.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
- name: envoy.filters.http.ratelimit
typedConfig:
'@type': type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
disableXEnvoyRatelimitedHeader: true
domain: first-listener
enableXRatelimitHeaders: DRAFT_VERSION_03
rateLimitService:
Expand Down
1 change: 1 addition & 0 deletions release-notes/current.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ bug fixes: |
Fixed validation for grpc routes with extension ref filters.
Fixed service account token handling in GatewayNamespaceMode to use SDS for properly refreshing expired token.
Fixed handling of regex meta characters in prefix match replace for URL rewrite.
Disabled the default emission of `x-envoy-ratelimited` headers from the rate limit filter; re-enable with the `enableEnvoyHeaders` setting in ClientTrafficPolicy.

# Enhancements that improve performance.
performance improvements: |
Expand Down
Loading