EnvoyFilter RateLimit pattern regex not working , need help!

[wmashal]

Hi

I am trying to configure my Global Rate limit in istio using the EnvoyFilter resource to handle a a dynamic URL requests rate limit, my url contains a dynamic UUID in the path so I tried to use regex_value_rewrite pattern but its not working as expected, I expect to have a request count for each unique UUID, and not apply the rate limit on any other paths just if I have the UUID Regex

Example:

lets say we have limit 50 req/minute

/cloudautomation/v1/solutions//spfi/notify called 2 times --- > count1 is 2 out of 50
/cloudautomation/v1/solutions//spfi/notify called 10 times ---> count2 is 10 out of 50

My Configurations

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: ratelimit-envoy-filter
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: GATEWAY
        listener:
          filterChain:
            filter:
              name: 'envoy.filters.network.http_connection_manager'
              subFilter:
                name: 'envoy.filters.http.router'
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.header_to_metadata
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.http.header_to_metadata.v3.Config
            request_rules:
            - header: ':path'
              on_header_present:
                # use an arbitary name for the namespace
                # will be used later to extract descriptor value
                metadata_namespace: spfi
                # use an arbitary key for the metadata
                # will be used later to extract descriptor value
                key: uri
                regex_value_rewrite:
                  pattern:
                    # regex matcher
                    google_re2: {}
                    # truncates parameters from path
                    regex: '^\/cloudautomation\/v1\/solutions\/(.+)\/spfi\/notify$'
                  substitution: '\1'
    - applyTo: HTTP_FILTER
      match:
        context: GATEWAY
        listener:
          filterChain:
            filter:
              name: "envoy.filters.network.http_connection_manager"
              subFilter:
                name: "envoy.filters.http.router"
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.ratelimit
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
            domain: atom-istio-ratelimit
            failure_mode_deny: false
            timeout: 10s
            rate_limit_service:
              grpc_service:
                envoy_grpc:
                  cluster_name: outbound|8081||ratelimit.istio-system.svc.cluster.local
                  authority: ratelimit.istio-system.svc.cluster.local
              transport_api_version: V3

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: uca-spfi-ratelimit-actions
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: VIRTUAL_HOST
    match:
      context: GATEWAY
      routeConfiguration:
        vhost:
          name: {{ .Values.uca.ingress.appPrefix }}.ingress.{{ .Values.domain }}:443
          route:
            action: ANY
    patch:
      operation: MERGE
      value:
        rate_limits:
        - actions:
          - metadata:
              descriptor_key: SPFI
              metadata_key:
                key: spfi
                path:
                - key: uri

In the rate limit service config I configured

   - key: SPFI
     rate_limit:
       unit: MINUTE
       requests_per_unit: 50

Please Advice ?
Thanks

[YuvalSosmanovich]

We encountered a similar issue and would appreciate an answer.