DocsEdge StackBasic rate limiting
Basic rate limiting
Ambassador Edge Stack can validate incoming requests before routing them to a backing service. In this tutorial, we'll configure Ambassador Edge Stack to use a simple third party rate limit service. (If you don't want to implement your own rate limiting service, Ambassador Edge Stack integrates a powerful, flexible rate limiting service.)
Before you get started
This tutorial assumes you have already followed the Ambassador Edge Stack Installation and Quickstart Tutorial guides. If you haven't done that already, you should do so now.
Once completed, you'll have a Kubernetes cluster running Ambassador Edge Stack and the Quote service. Let's walk through adding rate limiting to this setup.
1. Deploy the rate limit service
Ambassador Edge Stack delegates the actual rate limit logic to a third party service. We've written a simple rate limit service that:
- listens for requests on port 5000;
- handles gRPC
shouldRateLimit
requests; - allows requests with the
x-emissary-test-allow: "true"
header; and - marks all other requests as
OVER_LIMIT
;
Here's the YAML we'll start with:
Once this configuration is applied Kubernetes will startup the example ratelimit service and Ambassador Edge Stack will be configured to use the rate limit service. The RateLimitService
configuration tells Ambassador Edge Stack to:
- Send
ShouldRateLimit
check request toratelimit-example.default:5000
- Configure Envoy to talk with the example ratelimit service using transport protocol
v3
(only supported version) - Set the labels
domain
toemissary
(labels discussed below)
2. Configure Ambassador Edge Stack Mappings
Ambassador Edge Stack only validates requests on Mapping
s which set labels to use for rate limiting, so you'll need to apply labels
to your Mapping
s to enable rate limiting. For more information
on the labelling process, see the Rate Limits configuration documentation.
Labels are added to a Mapping
using the labels
field and domain
configured in the RateLimitService
. For example:
If we were to apply it the Mapping
definition for the quote-backend
service outlined in the quick-start then it would look like this:
Note that the key
could be anything you like, but our example rate limiting service expects it to match the name of the header. Also note that since our RateLimitService
expects to use labels in the
emissary
domain, our Mapping
must match.
2. Test rate limiting
If we curl
to a rate-limited URL:
We get a 429
status code, since we are being rate limited.
If we set the correct header value to the service request, we will get a quote successfully:
More
For more details about configuring the external rate limit service, read the rate limit documentation.