From 8019ae4cb85ceb42a8f41d94b2d01921cb5341e6 Mon Sep 17 00:00:00 2001
From: sh2 <shawnhxh@outlook.com>
Date: Wed, 9 Aug 2023 15:16:51 +0800
Subject: [PATCH] follow-up(doc, fix): support for grpcroute ratelimitfilter
 (#1766)

* bug fix: should not continue if grpcroute has no authenfilters

Signed-off-by: sh2 <shawnhxh@outlook.com>

* add doc for grpcroute ratelimitfilter

Signed-off-by: sh2 <shawnhxh@outlook.com>

* change doc to latest

Signed-off-by: sh2 <shawnhxh@outlook.com>

* update doc and fix comment

Signed-off-by: sh2 <shawnhxh@outlook.com>

---------

Signed-off-by: sh2 <shawnhxh@outlook.com>
Co-authored-by: Xunzhuo <bitliu@tencent.com>
---
 docs/latest/user/rate-limit.md             | 276 ++++++++++++++++++++-
 internal/provider/kubernetes/controller.go |   9 -
 internal/provider/kubernetes/filters.go    |   9 +
 internal/provider/kubernetes/routes.go     |  50 ++--
 4 files changed, 313 insertions(+), 31 deletions(-)

diff --git a/docs/latest/user/rate-limit.md b/docs/latest/user/rate-limit.md
index 9beebf65f4b..45e35b58e64 100644
--- a/docs/latest/user/rate-limit.md
+++ b/docs/latest/user/rate-limit.md
@@ -2,7 +2,7 @@
 
 Rate limit is a feature that allows the user to limit the number of incoming requests to a predefined value based on attributes within the traffic flow.
 
-Here are some reasons why you may want to implements Rate limits
+Here are some reasons why you may want to implement Rate limits
 
 * To prevent malicious activity such as DDoS attacks.
 * To prevent applications and its resources (such as a database) from getting overloaded.
@@ -13,13 +13,13 @@ i.e. if the data plane has 2 replicas of Envoy running, and the rate limit is 10
 if 5 requests pass through the first replica and 5 requests pass through the second replica within the same second.
 
 Envoy Gateway introduces a new CRD called [RateLimitFilter][] that allows the user to describe their rate limit intent. This instantiated resource
-can be linked to a [HTTPRoute][] resource using an [ExtensionRef][] filter.
+can be linked to a [HTTPRoute][] or [GRPCRoute][] resource using an [ExtensionRef][] filter.
 
 ## Prerequisites
 
 ### Install Envoy Gateway
 
-* Follow the steps from the [Quickstart Guide](quickstart.md) to install Envoy Gateway and the example manifest.
+* Follow the steps from the [Quickstart Guide](quickstart.md) to install Envoy Gateway and the HTTPRoute example manifest.
 Before proceeding, you should be able to query the example backend using HTTP.
 
 ### Install Redis
@@ -143,7 +143,13 @@ spec:
       limit:
         requests: 3
         unit: Hour
----
+EOF
+```
+
+### HTTPRoute
+
+```shell
+cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1beta1
 kind: HTTPRoute
 metadata:
@@ -266,6 +272,108 @@ server: envoy
 
 ```
 
+### GRPCRoute
+
+Before proceeding, you should install the GRPCRoute example from [GRPC Routing](grpc-routing.md),
+and be able to query the example backend using GRPC.
+
+```shell
+cat <<EOF | kubectl apply -f -
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: GRPCRoute
+metadata:
+  name: yages
+  labels:
+    example: grpc-routing
+spec:
+  parentRefs:
+  - name: example-gateway
+  hostnames:
+  - "grpc-example.com"
+  rules:
+  - matches:
+    - method:
+        method: ServerReflectionInfo
+        service: grpc.reflection.v1alpha.ServerReflection
+    - method:
+        method: Ping
+    filters:
+    - type: ExtensionRef
+      extensionRef:
+        group: gateway.envoyproxy.io
+        kind: RateLimitFilter
+        name: ratelimit-specific-user
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: yages
+      port: 9000
+      weight: 1
+EOF
+```
+
+The GRPCRoute status should indicate that it has been accepted and is bound to the example Gateway.
+
+```shell
+kubectl get grpcroute/yages -o yaml
+```
+
+Get the Gateway's address:
+
+```shell
+export GATEWAY_HOST=$(kubectl get gateway/example-gateway -o jsonpath='{.status.addresses[0].value}')
+```
+
+Lets query `grpc-example.com` with `yages.Echo/Ping` 4 times. We should receive a `pong` response from the example Gateway for the first 3 requests
+and then receive a rpc error for the 4th request since the limit is set at 3 requests/Hour for the request which contains the header `x-user-id`
+and value `one`.
+
+```shell
+for i in {1..4}; do grpcurl -plaintext -authority=grpc-example.com -H "x-user-id: one" ${GATEWAY_HOST}:80 yages.Echo/Ping ; sleep 1; done
+```
+
+```console
+{
+  "text": "pong"
+}
+
+{
+  "text": "pong"
+}
+
+{
+  "text": "pong"
+}
+
+Error invoking method "yages.Echo/Ping": rpc error: code = Unavailable desc = failed to query for service descriptor "yages.Echo":
+
+```
+
+You should be able to send requests with the `x-user-id` header and a different value and receive successful responses from the server.
+
+```shell
+for i in {1..4}; do grpcurl -plaintext -authority=grpc-example.com -H "x-user-id: two" ${GATEWAY_HOST}:80 yages.Echo/Ping ; sleep 1; done
+```
+
+```console
+{
+  "text": "pong"
+}
+
+{
+  "text": "pong"
+}
+
+{
+  "text": "pong"
+}
+
+{
+  "text": "pong"
+}
+
+```
+
 ## Rate Limit Distinct Users 
 
 Here is an example of a rate limit implemented by the application developer to limit distinct users who can be differentiated based on the 
@@ -289,7 +397,13 @@ spec:
       limit:
         requests: 3
         unit: Hour
----
+EOF
+```
+
+### HTTPRoute
+
+```shell
+cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1beta1
 kind: HTTPRoute
 metadata:
@@ -318,7 +432,6 @@ spec:
 EOF
 ```
 
-
 Lets run the same command again with the header `x-user-id` and value `one` set in the request. We should the first 3 requests succeeding and
 the 4th request being rate limited.
 
@@ -398,6 +511,93 @@ transfer-encoding: chunked
 
 ```
 
+### GRPCRoute
+
+Before proceeding, you should install the GRPCRoute example from [GRPC Routing](grpc-routing.md),
+and be able to query the example backend using GRPC.
+
+```shell
+cat <<EOF | kubectl apply -f -
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: GRPCRoute
+metadata:
+  name: yages
+  labels:
+    example: grpc-routing
+spec:
+  parentRefs:
+  - name: example-gateway
+  hostnames:
+  - "grpc-example.com"
+  rules:
+  - matches:
+    - method:
+        method: ServerReflectionInfo
+        service: grpc.reflection.v1alpha.ServerReflection
+    - method:
+        method: Ping
+    filters:
+    - type: ExtensionRef
+      extensionRef:
+        group: gateway.envoyproxy.io
+        kind: RateLimitFilter
+        name: ratelimit-distinct-users
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: yages
+      port: 9000
+      weight: 1
+EOF
+```
+
+Lets run the same command again with the header `x-user-id` and value `one` set in the request. We should the first 3 requests succeeding and
+the 4th request being rate limited.
+
+```shell
+for i in {1..4}; do grpcurl -plaintext -authority=grpc-example.com -H "x-user-id: one" ${GATEWAY_HOST}:80 yages.Echo/Ping ; sleep 1; done
+```
+
+```console
+{
+  "text": "pong"
+}
+
+{
+  "text": "pong"
+}
+
+{
+  "text": "pong"
+}
+
+Error invoking method "yages.Echo/Ping": rpc error: code = Unavailable desc = failed to query for service descriptor "yages.Echo":
+
+```
+
+You should see the same behavior when the value for header `x-user-id` is set to `two` and 4 requests are sent.
+
+```shell
+for i in {1..4}; do grpcurl -plaintext -authority=grpc-example.com -H "x-user-id: two" ${GATEWAY_HOST}:80 yages.Echo/Ping ; sleep 1; done
+```
+
+```console
+{
+  "text": "pong"
+}
+
+{
+  "text": "pong"
+}
+
+{
+  "text": "pong"
+}
+
+Error invoking method "yages.Echo/Ping": rpc error: code = Unavailable desc = failed to query for service descriptor "yages.Echo":
+
+```
+
 ## Rate Limit All Requests 
 
 This example shows you how to rate limit all requests matching the HTTPRoute rule at 3 requests/Hour by leaving the `clientSelectors` field unset.
@@ -415,7 +615,13 @@ spec:
     - limit:
         requests: 3
         unit: Hour
----
+EOF
+```
+
+### HTTPRoute
+
+```shell
+cat <<EOF | kubectl apply -f -
 apiVersion: gateway.networking.k8s.io/v1beta1
 kind: HTTPRoute
 metadata:
@@ -481,6 +687,61 @@ transfer-encoding: chunked
 
 ```
 
+### GRPCRoute
+
+Before proceeding, you should install the GRPCRoute example from [GRPC Routing](grpc-routing.md),
+and be able to query the example backend using GRPC.
+
+```shell
+cat <<EOF | kubectl apply -f -
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: GRPCRoute
+metadata:
+  name: yages
+  labels:
+    example: grpc-routing
+spec:
+  parentRefs:
+  - name: example-gateway
+  hostnames:
+  - "grpc-example.com"
+  rules:
+  - matches:
+    - method:
+        method: ServerReflectionInfo
+        service: grpc.reflection.v1alpha.ServerReflection
+    - method:
+        method: Ping
+    filters:
+    - type: ExtensionRef
+      extensionRef:
+        group: gateway.envoyproxy.io
+        kind: RateLimitFilter
+        name: ratelimit-all-requests
+    backendRefs:
+    - group: ""
+      kind: Service
+      name: yages
+      port: 9000
+      weight: 1
+EOF
+```
+
+```shell
+for i in {1..4}; do grpcurl -plaintext -authority=grpc-example.com ${GATEWAY_HOST}:80 yages.Echo/Ping ; sleep 1; done
+```
+
+```console
+Error invoking method "yages.Echo/Ping": rpc error: code = Unavailable desc = failed to query for service descriptor "yages.Echo":
+
+Error invoking method "yages.Echo/Ping": rpc error: code = Unavailable desc = failed to query for service descriptor "yages.Echo":
+
+Error invoking method "yages.Echo/Ping": rpc error: code = Unavailable desc = failed to query for service descriptor "yages.Echo":
+
+Error invoking method "yages.Echo/Ping": rpc error: code = Unavailable desc = failed to query for service descriptor "yages.Echo":
+
+```
+
 ## Rate Limit Client IP Addresses
 
 Here is an example of a rate limit implemented by the application developer to limit distinct users who can be differentiated based on their
@@ -805,4 +1066,5 @@ kubectl rollout restart deployment envoy-gateway -n envoy-gateway-system
 [Envoy Ratelimit]: https://github.com/envoyproxy/ratelimit
 [EnvoyGateway]: https://gateway.envoyproxy.io/latest/api/config_types.html#envoygateway
 [HTTPRoute]: https://gateway-api.sigs.k8s.io/api-types/httproute/
+[GRPCRoute]: https://gateway-api.sigs.k8s.io/api-types/grpcroute/
 [ExtensionRef]: https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io%2fv1beta1.HTTPRouteFilter
diff --git a/internal/provider/kubernetes/controller.go b/internal/provider/kubernetes/controller.go
index 36c98a6be67..9adae79407d 100644
--- a/internal/provider/kubernetes/controller.go
+++ b/internal/provider/kubernetes/controller.go
@@ -417,15 +417,6 @@ func (r *gatewayAPIReconciler) findReferenceGrant(ctx context.Context, from, to
 	return nil, nil
 }
 
-func (r *gatewayAPIReconciler) getRateLimitFilters(ctx context.Context) ([]egv1a1.RateLimitFilter, error) {
-	rateLimitList := new(egv1a1.RateLimitFilterList)
-	if err := r.client.List(ctx, rateLimitList); err != nil {
-		return nil, fmt.Errorf("failed to list RateLimitFilters: %v", err)
-	}
-
-	return rateLimitList.Items, nil
-}
-
 func (r *gatewayAPIReconciler) processGateways(ctx context.Context, acceptedGC *gwapiv1b1.GatewayClass, resourceMap *resourceMappings, resourceTree *gatewayapi.Resources) error {
 	// Find gateways for the acceptedGC
 	// Find the Gateways that reference this Class.
diff --git a/internal/provider/kubernetes/filters.go b/internal/provider/kubernetes/filters.go
index 5f82322c589..be216881e4e 100644
--- a/internal/provider/kubernetes/filters.go
+++ b/internal/provider/kubernetes/filters.go
@@ -23,6 +23,15 @@ func (r *gatewayAPIReconciler) getAuthenticationFilters(ctx context.Context) ([]
 	return authenList.Items, nil
 }
 
+func (r *gatewayAPIReconciler) getRateLimitFilters(ctx context.Context) ([]egv1a1.RateLimitFilter, error) {
+	rateLimitList := new(egv1a1.RateLimitFilterList)
+	if err := r.client.List(ctx, rateLimitList); err != nil {
+		return nil, fmt.Errorf("failed to list RateLimitFilters: %v", err)
+	}
+
+	return rateLimitList.Items, nil
+}
+
 func (r *gatewayAPIReconciler) getExtensionRefFilters(ctx context.Context) ([]unstructured.Unstructured, error) {
 	var resourceItems []unstructured.Unstructured
 	for _, gvk := range r.extGVKs {
diff --git a/internal/provider/kubernetes/routes.go b/internal/provider/kubernetes/routes.go
index ecb95408142..9aa650778fb 100644
--- a/internal/provider/kubernetes/routes.go
+++ b/internal/provider/kubernetes/routes.go
@@ -169,24 +169,44 @@ func (r *gatewayAPIReconciler) processGRPCRoutes(ctx context.Context, gatewayNam
 				}
 				if filter.Type == gwapiv1a2.GRPCRouteFilterExtensionRef {
 					// NOTE: filters must be in the same namespace as the GRPCRoute
-					key := types.NamespacedName{
-						Namespace: grpcRoute.Namespace,
-						Name:      string(filter.ExtensionRef.Name),
-					}
+					switch string(filter.ExtensionRef.Kind) {
+					case egv1a1.KindAuthenticationFilter:
+						key := types.NamespacedName{
+							Namespace: grpcRoute.Namespace,
+							Name:      string(filter.ExtensionRef.Name),
+						}
+						authFilter, ok := resourceMap.authenFilters[key]
+						if !ok {
+							r.log.Error(err, "AuthenticationFilter not found; bypassing rule", "index", i)
+						}
 
-					authFilter, ok := resourceMap.authenFilters[key]
-					if !ok {
-						r.log.Error(err, "AuthenticationFilter not found; bypassing rule", "index", i)
-						continue
-					}
-					resourceTree.AuthenticationFilters = append(resourceTree.AuthenticationFilters, authFilter)
+						resourceTree.AuthenticationFilters = append(resourceTree.AuthenticationFilters, authFilter)
+					case egv1a1.KindRateLimitFilter:
+						key := types.NamespacedName{
+							Namespace: grpcRoute.Namespace,
+							Name:      string(filter.ExtensionRef.Name),
+						}
+						rateLimitFilter, ok := resourceMap.rateLimitFilters[key]
+						if !ok {
+							r.log.Error(err, "RateLimitFilter not found; bypassing rule", "index", i)
+						}
 
-					rateLimitFilter, ok := resourceMap.rateLimitFilters[key]
-					if !ok {
-						r.log.Error(err, "RateLimitFilter not found; bypassing rule", "index", i)
-						continue
+						resourceTree.RateLimitFilters = append(resourceTree.RateLimitFilters, rateLimitFilter)
+					default:
+						// If the Kind does not match any Envoy Gateway resources, check if it's a Kind
+						// managed by an extension and add to resourceTree
+						key := types.NamespacedName{
+							Namespace: grpcRoute.Namespace,
+							Name:      string(filter.ExtensionRef.Name),
+						}
+						extRefFilter, ok := resourceMap.extensionRefFilters[key]
+						if !ok {
+							r.log.Error(err, "Filter not found; bypassing rule", "name", filter.ExtensionRef.Name, "index", i)
+							continue
+						}
+
+						resourceTree.ExtensionRefFilters = append(resourceTree.ExtensionRefFilters, extRefFilter)
 					}
-					resourceTree.RateLimitFilters = append(resourceTree.RateLimitFilters, rateLimitFilter)
 				}
 			}
 		}