envoyproxy / envoyproxy/envoy

EnvoyFilter RateLimit pattern regex not working , need help!

Open
#34,197 12 comments 0 reactions 0 assignees View on GitHub
area/ratelimit no stalebot question
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 20h
Merged PRs (30d)
437

Description

Hi

I am trying to configure my Global Rate limit in istio using the EnvoyFilter resource to handle a a dynamic URL requests rate limit, my url contains a dynamic UUID in the path so I tried to use regex_value_rewrite pattern but its not working as expected, I expect to have a request count for each unique UUID, and not apply the rate limit on any other paths just if I have the UUID Regex

Example:

lets say we have **limit 50 req/minute**, and 2 requests with 2 different UUIDs

/cloudautomation/v1/solutions/UUID-1/spfi/notify called 2 times --- > **count1 is 2 out of 50**
/cloudautomation/v1/solutions/UUID-2/spfi/notify called 10 times ---> **count2 is 10 out of 50**

**My Configurations**

```yaml
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: ratelimit-envoy-filter
namespace: istio-system
spec:
workloadSelector:
labels:
istio: ingressgateway
configPatches:
- applyTo: HTTP_FILTER
match:
context: GATEWAY
listener:
filterChain:
filter:
name: 'envoy.filters.network.http_connection_manager'
subFilter:
name: 'envoy.filters.http.router'
patch:
operation: INSERT_BEFORE
value:
name: envoy.filters.http.header_to_metadata
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.header_to_metadata.v3.Config
request_rules:
- header: ':path'
on_header_present:
# use an arbitary name for the namespace
# will be used later to extract descriptor value
metadata_namespace: spfi
# use an arbitary key for the metadata
# will be used later to extract descriptor value
key: uri
regex_value_rewrite:
pattern:
# regex matcher
google_re2: {}
# truncates parameters from path
regex: '^\/cloudautomation\/v1\/solutions\/(.+)\/spfi\/notify$'
substitution: '\1'
- applyTo: HTTP_FILTER
match:
context: GATEWAY
listener:
filterChain:
filter:
name: "envoy.filters.network.http_connection_manager"
subFilter:
name: "envoy.filters.http.router"
patch:
operation: INSERT_BEFORE
value:
name: envoy.filters.http.ratelimit
typed_config:
"@type": type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
domain: atom-istio-ratelimit
failure_mode_deny: false
timeout: 10s
rate_limit_service:
grpc_service:
envoy_grpc:
cluster_name: outbound|8081||ratelimit.istio-system.svc.cluster.local
authority: ratelimit.istio-system.svc.cluster.local
transport_api_version: V3

```
```yaml
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
name: uca-spfi-ratelimit-actions
namespace: istio-system
spec:
workloadSelector:
labels:
istio: ingressgateway
configPatches:
- applyTo: VIRTUAL_HOST
match:
context: GATEWAY
routeConfiguration:
vhost:
name: {{ .Values.uca.ingress.appPrefix }}.ingress.{{ .Values.domain }}:443
route:
action: ANY
patch:
operation: MERGE
value:
rate_limits:
- actions:
- metadata:
descriptor_key: SPFI
metadata_key:
key: spfi
path:
- key: uri
```

In the rate limit service config I configured

```yaml
- key: SPFI
rate_limit:
unit: MINUTE
requests_per_unit: 50
```
Please Advice ?
Thanks

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.