-
Notifications
You must be signed in to change notification settings - Fork 273
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add rate-limiters to ServerPolicy #3305
Conversation
0536b1f
to
8636f8e
Compare
This adds the local_rate_limit module to the server-policy crate, that `ServerPolicy` uses for its new `local_rate_limit` field, containing three optional rate-limiters: total, identity, overrides (this one is really a vector of limiters, one per configured override). I tried putting that under `Protocol` instead, but the `PartialEq` requirement made it very hard to follow. `Server` OTOH doesn't really require that trait, so I was able to remove it and accommodate the limiters. I made sure to avoid pulling the dashmap dependency in `governor`; I haven't checked yet the necessity of the "jitter" and "quanta" features. This temporarily overrides linkerd2-proxy-api dependency to pick changes from linkerd/linkerd2-proxy-api#388
8636f8e
to
b580e65
Compare
af63198
to
6d9a4a7
Compare
adb0cc9
to
15ec396
Compare
15ec396
to
3af685b
Compare
We only expect to use `LocalRateLimit::new_no_overrides` for tests. This change adds a test-util feature to the server-policy crate so that we can assert that this constructor doesn't sneak into release code.
match err { | ||
RateLimitError::PerIdentity(rps) => assert_eq!(rps, &std::num::NonZeroU32::new(1).unwrap()), | ||
_ => panic!("unexpected error"), | ||
}; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nit: slightly more readable:
match err { | |
RateLimitError::PerIdentity(rps) => assert_eq!(rps, &std::num::NonZeroU32::new(1).unwrap()), | |
_ => panic!("unexpected error"), | |
}; | |
match err { | |
RateLimitError::PerIdentity(rps) => assert_eq!(rps.into(), 1), | |
_ => panic!("unexpected error"), | |
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Clippy doesn't like that 😞
error[E0283]: type annotations needed
--> linkerd/app/inbound/src/policy/http/tests.rs:465:60
|
465 | RateLimitError::PerIdentity(rps) => assert_eq!(rps.into(), 1),
| ^^^^
|
= note: cannot satisfy `_: std::convert::From<&std::num::NonZeroU32>`
= note: required for `&std::num::NonZeroU32` to implement `std::convert::Into<_>`
help: try using a fully qualified path to specify the expected types
|
465 | RateLimitError::PerIdentity(rps) => assert_eq!(<&std::num::NonZeroU32 as std::convert::Into<T>>::into(rps), 1),
| +++++++++++++++++++++++++++++++++++++++++++++++++++++++ ~
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Take note that we'll want to update the commit message to reflect the current state of this branch.
This adds the local_rate_limit module to the server-policy crate, that
ServerPolicy
uses for its newlocal_rate_limit
field, containingthree optional rate-limiters: total, identity, overrides (this one is
really a vector of limiters, one per configured override).
I tried putting that under
Protocol
instead, but thePartialEq
requirement made it very hard to follow.
Server
OTOH doesn't reallyrequire that trait, so I was able to remove it and accommodate the
limiters.
I made sure to avoid pulling the dashmap dependency in
governor
;Ihaven't checked yet the necessity of the "jitter" and "quanta" features.
This temporarily overrides linkerd2-proxy-api dependency to pick changes
from linkerd/linkerd2-proxy-api#388
Update
The
HttpPolicyService
middleware has been expanded to call thelocal_rate_limit
module above to perform the rate-limit check.