Envoy rate limit v3 API fail: Unexpected HTTP/1.x request: POST /envoy.service.ratelimit.v3.RateLimitService/ShouldRateLimit
- Dominant language
- Java
- Stars
- 23.1k
- Forks
- 8.1k
- PR merge metrics
- No merged PRs in 30d
Description
## Issue Description
envoy rate limit fail
[2021-09-06T10:24:38.050Z] "GET /productpage HTTP/1.1" 500 - rate_limiter_error - "-" 0 0 18 - "172.20.0.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Edg/93.0.961.38" "bc018697-9011-97bb-97a3-047021de0ac4" "bookinfo.com:32545" "-" outbound|9080||productpage.istio.svc.cluster.local - 172.20.0.52:8080 172.20.0.1:58561 - -
[2021-09-06T10:24:39.603Z] "GET /productpage HTTP/1.1" 500 - rate_limiter_error - "-" 0 0 3 - "172.20.0.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Edg/93.0.961.38" "ff4fe770-0150-9f44-8996-e7889bd98ce2" "bookinfo.com:32545" "-" outbound|9080||productpage.istio.svc.cluster.local - 172.20.0.52:8080 172.20.0.1:58561 - -
Type: *bug report* or *feature request*
### Describe what happened (or what feature you want)
```
```
### Describe what you expected to happen
### How to reproduce it (as minimally and precisely as possible)
```
envoyfilters/ratelimit/sentinel/config.yaml
kubectl apply -f config.yaml -n istio
apiVersion: v1
kind: ConfigMap
metadata:
name: ratelimit-config
data:
config.yaml: |
domain: productpage-ratelimit
descriptors:
- key: PATH
value: "/productpage"
rate_limit:
unit: minute
requests_per_unit: 1
- key: PATH
rate_limit:
unit: minute
requests_per_unit: 100
envoyfilters/ratelimit/sentinel/sentinel-deploy.yaml
kubectl apply -f sentinel-deploy.yaml -n istio
apiVersion: apps/v1
kind: Deployment
metadata:
name: sentinel-rls-server
labels:
app: sentinel
spec:
replicas: 1
selector:
matchLabels:
app: sentinel
template:
metadata:
labels:
app: sentinel
spec:
containers:
- name: sentinelserver
image: "registry.cn-hangzhou.aliyuncs.com/sentinel-docker-repo/sentinel-envoy-rls-server:latest"
imagePullPolicy: Always
ports:
- containerPort: 10245
- containerPort: 8719
volumeMounts:
- name: sentinel-rule-config
mountPath: /tmp/sentinel
env:
- name: SENTINEL_RLS_RULE_FILE_PATH
value: "/tmp/sentinel/rule.yaml"
volumes:
- name: sentinel-rule-config
configMap:
name: ratelimit-config
items:
- key: config.yaml
path: rule.yaml
---
apiVersion: v1
kind: Service
metadata:
name: sentinel-rls-service
labels:
name: sentinel-rls-service
spec:
type: ClusterIP
ports:
- port: 8719
targetPort: 8719
name: sentinel-command
- port: 10245
targetPort: 10245
name: sentinel-grpc
selector:
app: sentinel
envoyfilters/ratelimit/sentinel/ef-sentinel-filter.yaml
kubectl apply -f ef-sentinel-filter.yaml -n istio-system
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: filter-ratelimit
namespace: istio-system
spec:
workloadSelector:
labels:
istio: ingressgateway
configPatches:
- applyTo: HTTP_FILTER
match:
context: GATEWAY
listener:
filterChain:
filter:
name: "envoy.filters.network.http_connection_manager"
subFilter:
name: "envoy.filters.http.router"
patch:
operation: INSERT_BEFORE
value:
name: envoy.filters.http.ratelimit
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
domain: productpage-ratelimit
failure_mode_deny: true
stage: 0
rate_limit_service:
grpc_service:
envoy_grpc:
cluster_name: rate_limit_cluster
timeout: 10s
transport_api_version: V3
- applyTo: CLUSTER
match:
cluster:
service: sentinel-rls-service.istio.svc.cluster.local
patch:
operation: ADD
value:
name: rate_limit_cluster
type: STRICT_DNS
connect_timeout: 10s
lb_policy: ROUND_ROBIN
http2_protocol_options: {}
load_assignment:
cluster_name: rate_limit_cluster
endpoints:
- lb_endpoints:
- endpoint:
address:
socket_address:
address: sentinel-rls-service.istio.svc.cluster.local
port_value: 10245
ef-sentinel-filter-action.yaml
kubectl apply -f ef-sentinel-filter-action.yaml -n istio-system
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: filter-ratelimit-svc
namespace: istio-system
spec:
workloadSelector:
labels:
istio: ingressgateway
configPatches:
- applyTo: VIRTUAL_HOST
match:
context: GATEWAY
routeConfiguration:
vhost:
name: "*:80"
route:
action: ANY
patch:
operation: MERGE
value:
rate_limits:
- actions:
- request_headers:
header_name: ":path"
descriptor_key: "PATH"
```
### Tell us your environment
istio 1.11.0
### Anything else we need to know?
Contributor guide
Research direction
Start by reproducing the failure with envoyfilters/ratelimit/sentinel/config.yaml, sentinel-deploy.yaml, ef-sentinel-filter.yaml, and ef-sentinel-filter-action.yaml, then inspect the Envoy and Sentinel service logs around the HTTP/1.x request error. Done means the v3 rate-limit service call succeeds and requests to /productpage no longer return rate_limiter_error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- grpc, kubernetes
- Domain
- backend, cloud, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100