Basic rate limiting

Emissary-ingress can validate incoming requests before routing them to a backing service. In this tutorial, we'll configure Emissary-ingress to use a simple third party rate limit service. (If you don't want to implement your own rate limiting service, Ambassador Edge Stack integrates a powerful, flexible rate limiting service.)

Before you get started

This tutorial assumes you have already followed the Emissary-ingress Installation and Quickstart Tutorial guides. If you haven't done that already, you should do so now.

Once completed, you'll have a Kubernetes cluster running Emissary-ingress and the Quote service. Let's walk through adding rate limiting to this setup.

1. Deploy the rate limit service

Emissary-ingress delegates the actual rate limit logic to a third party service. We've written a simple rate limit service that:

• listens for requests on port 5000;
• handles gRPC shouldRateLimit requests;
• allows requests with the x-emissary-test-allow: "true" header; and
• marks all other requests as OVER_LIMIT;

Here's the YAML we'll start with:

Once this configuration is applied Kubernetes will startup the example ratelimit service and Emissary-ingress will be configured to use the rate limit service. The RateLimitService configuration tells Emissary-ingress to:

• Send ShouldRateLimit check request to ratelimit-example.default:5000
• Configure Envoy to talk with the example ratelimit service using transport protocol v3 (only supported version)
• Set the labels domain to emissary (labels discussed below)

2. Configure Emissary-ingress Mappings

Emissary-ingress only validates requests on Mappings which set labels to use for rate limiting, so you'll need to apply labels to your Mappings to enable rate limiting. For more information on the labelling process, see the Rate Limits configuration documentation.

Labels are added to a Mapping using the labels field and domain configured in the RateLimitService. For example:

If we were to apply it the Mapping definition for the quote-backend service outlined in the quick-start then it would look like this:

Note that the key could be anything you like, but our example rate limiting service expects it to match the name of the header. Also note that since our RateLimitService expects to use labels in the emissary domain, our Mapping must match.

2. Test rate limiting

If we curl to a rate-limited URL:

We get a 429 status code, since we are being rate limited.

If we set the correct header value to the service request, we will get a quote successfully:

More

For more details about configuring the external rate limit service, read the rate limit documentation.