Envoy Rate Limit Service(RLS) 本地/远程限流配置实践

Envoy 过滤器与路由配置：static_resources:

listeners:

- name: listener_0

address:

socket_address: { address: 0.0.0.0, port_value: 8080 }

filter_chains:

- filters:

- name: envoy.filters.network.http_connection_manager

typed_config:

"@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager

stat_prefix: ingress_http

route_config:

name: local_route

virtual_hosts:

- name: backend

domains: ["*"]

routes:

- match: { prefix: "/api" }

rate_limits:

- actions:

- request_headers:

header_name: x-user-tier

descriptor_key: user_tier

route: { cluster: app }

http_filters:

- name: envoy.filters.http.ratelimit

typed_config:

"@type": type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit

domain: api

rate_limit_service:

grpc_service:

envoy_grpc:

cluster_name: rls

timeout: 0.25s

transport_api_version: V3

- name: envoy.filters.http.router

clusters:

- name: app

type: LOGICAL_DNS

connect_timeout: 1s

lb_policy: ROUND_ROBIN

load_assignment:

cluster_name: app

endpoints:

- lb_endpoints:

- endpoint:

address:

socket_address: { address: 127.0.0.1, port_value: 7001 }

- name: rls

type: LOGICAL_DNS

connect_timeout: 1s

lb_policy: ROUND_ROBIN

http2_protocol_options: {}

load_assignment:

cluster_name: rls

endpoints:

- lb_endpoints:

- endpoint:

address:

socket_address: { address: 127.0.0.1, port_value: 8081 }

限流服务描述符配置（Lyft ratelimit 示例）：domain: api

descriptors:

- key: user_tier

value: free

rate_limit:

unit: minute

requests_per_unit: 100

- key: user_tier

value: pro

rate_limit:

unit: minute

requests_per_unit: 1000