alibaba / alibaba/Sentinel

Envoy rate limit v3 API fail: Unexpected HTTP/1.x request: POST /envoy.service.ratelimit.v3.RateLimitService/ShouldRateLimit

Open
#2,361 13 comments 0 reactions 0 assignees View on GitHub
area/cluster-flow kind/question
Dominant language
Java
Stars
23.1k
Forks
8.1k
PR merge metrics
No merged PRs in 30d

Description

## Issue Description
envoy rate limit fail
[2021-09-06T10:24:38.050Z] "GET /productpage HTTP/1.1" 500 - rate_limiter_error - "-" 0 0 18 - "172.20.0.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Edg/93.0.961.38" "bc018697-9011-97bb-97a3-047021de0ac4" "bookinfo.com:32545" "-" outbound|9080||productpage.istio.svc.cluster.local - 172.20.0.52:8080 172.20.0.1:58561 - -
[2021-09-06T10:24:39.603Z] "GET /productpage HTTP/1.1" 500 - rate_limiter_error - "-" 0 0 3 - "172.20.0.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Edg/93.0.961.38" "ff4fe770-0150-9f44-8996-e7889bd98ce2" "bookinfo.com:32545" "-" outbound|9080||productpage.istio.svc.cluster.local - 172.20.0.52:8080 172.20.0.1:58561 - -
Type: *bug report* or *feature request*

### Describe what happened (or what feature you want)
```

```

### Describe what you expected to happen

### How to reproduce it (as minimally and precisely as possible)
```
envoyfilters/ratelimit/sentinel/config.yaml

kubectl apply -f config.yaml -n istio

apiVersion: v1
kind: ConfigMap
metadata:
name: ratelimit-config
data:
config.yaml: |
domain: productpage-ratelimit
descriptors:
- key: PATH
value: "/productpage"
rate_limit:
unit: minute
requests_per_unit: 1
- key: PATH
rate_limit:
unit: minute
requests_per_unit: 100

envoyfilters/ratelimit/sentinel/sentinel-deploy.yaml

kubectl apply -f sentinel-deploy.yaml -n istio

apiVersion: apps/v1
kind: Deployment
metadata:
name: sentinel-rls-server
labels:
app: sentinel
spec:
replicas: 1
selector:
matchLabels:
app: sentinel
template:
metadata:
labels:
app: sentinel
spec:
containers:
- name: sentinelserver
image: "registry.cn-hangzhou.aliyuncs.com/sentinel-docker-repo/sentinel-envoy-rls-server:latest"
imagePullPolicy: Always
ports:
- containerPort: 10245
- containerPort: 8719
volumeMounts:
- name: sentinel-rule-config
mountPath: /tmp/sentinel
env:
- name: SENTINEL_RLS_RULE_FILE_PATH
value: "/tmp/sentinel/rule.yaml"
volumes:
- name: sentinel-rule-config
configMap:
name: ratelimit-config
items:
- key: config.yaml
path: rule.yaml
---
apiVersion: v1
kind: Service
metadata:
name: sentinel-rls-service
labels:
name: sentinel-rls-service
spec:
type: ClusterIP
ports:
- port: 8719
targetPort: 8719
name: sentinel-command
- port: 10245
targetPort: 10245
name: sentinel-grpc
selector:
app: sentinel

envoyfilters/ratelimit/sentinel/ef-sentinel-filter.yaml

kubectl apply -f ef-sentinel-filter.yaml -n istio-system

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: filter-ratelimit
namespace: istio-system
spec:
workloadSelector:
labels:
istio: ingressgateway
configPatches:
- applyTo: HTTP_FILTER
match:
context: GATEWAY
listener:
filterChain:
filter:
name: "envoy.filters.network.http_connection_manager"
subFilter:
name: "envoy.filters.http.router"
patch:
operation: INSERT_BEFORE
value:
name: envoy.filters.http.ratelimit
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
domain: productpage-ratelimit
failure_mode_deny: true
stage: 0
rate_limit_service:
grpc_service:
envoy_grpc:
cluster_name: rate_limit_cluster
timeout: 10s
transport_api_version: V3
- applyTo: CLUSTER
match:
cluster:
service: sentinel-rls-service.istio.svc.cluster.local
patch:
operation: ADD
value:
name: rate_limit_cluster
type: STRICT_DNS
connect_timeout: 10s
lb_policy: ROUND_ROBIN
http2_protocol_options: {}
load_assignment:
cluster_name: rate_limit_cluster
endpoints:
- lb_endpoints:
- endpoint:
address:
socket_address:
address: sentinel-rls-service.istio.svc.cluster.local
port_value: 10245

ef-sentinel-filter-action.yaml

kubectl apply -f ef-sentinel-filter-action.yaml -n istio-system

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: filter-ratelimit-svc
namespace: istio-system
spec:
workloadSelector:
labels:
istio: ingressgateway
configPatches:
- applyTo: VIRTUAL_HOST
match:
context: GATEWAY
routeConfiguration:
vhost:
name: "*:80"
route:
action: ANY
patch:
operation: MERGE
value:
rate_limits:
- actions:
- request_headers:
header_name: ":path"
descriptor_key: "PATH"

```

### Tell us your environment

istio 1.11.0
### Anything else we need to know?

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the failure with envoyfilters/ratelimit/sentinel/config.yaml, sentinel-deploy.yaml, ef-sentinel-filter.yaml, and ef-sentinel-filter-action.yaml, then inspect the Envoy and Sentinel service logs around the HTTP/1.x request error. Done means the v3 rate-limit service call succeeds and requests to /productpage no longer return rate_limiter_error.

Written by the indexing model from the issue text.

Assessment

Tech stack
grpc, kubernetes
Domain
backend, cloud, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.