Add support for General RateLimit Policy #5363

shadialtarsha · 2023-05-15T12:20:21Z

PR adds support for a global rate limit policy that can be defined in the RateLimit service configuration.

Proposal: #5359
Fixes: #5357

Signed-off-by: Shadi Altarsha shadi.altarsha.94@gmail.com

codecov · 2023-05-16T22:34:27Z

Codecov Report

Merging #5363 (43c1205) into main (b5acf7f) will increase coverage by 0.07%.
The diff coverage is 97.43%.

❗ Current head 43c1205 differs from pull request most recent head 6f22159. Consider uploading reports for the commit 6f22159 to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5363      +/-   ##
==========================================
+ Coverage   78.46%   78.53%   +0.07%     
==========================================
  Files         138      138              
  Lines       18896    18925      +29     
==========================================
+ Hits        14826    14863      +37     
+ Misses       3789     3783       -6     
+ Partials      281      279       -2

Impacted Files	Coverage Δ
pkg/config/parameters.go	`86.26% <ø> (+0.13%)`	⬆️
cmd/contour/serve.go	`20.15% <50.00%> (+0.04%)`	⬆️
cmd/contour/servecontext.go	`83.37% <100.00%> (+0.07%)`	⬆️
internal/dag/httpproxy_processor.go	`92.89% <100.00%> (+0.78%)`	⬆️
internal/dag/policy.go	`95.91% <100.00%> (ø)`

... and 2 files with indirect coverage changes

shadialtarsha · 2023-06-06T11:06:24Z

Hey @sunjayBhatia @skriss and @tsaarni
I would appreciate a round of review on this PR
Thank you!

davinci26

some comments around config generation

internal/dag/httpproxy_processor.go

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

shadialtarsha · 2023-06-10T16:54:22Z

@skriss and @sunjayBhatia
I would appreciate your review of this PR when you have time.
Thank you

clayton-gonsalves

we should also add a test to contour/internal/featuretests/v3/globalratelimit_test.go

examples/ratelimit/04-default-global-ratelimit-contour-config.yaml

internal/dag/httpproxy_processor.go

site/content/docs/main/guides/global-rate-limiting.md

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

apis/projectcontour/v1/httpproxy.go

changelogs/unreleased/5363-shadialtarsha-minor.md

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

shadialtarsha · 2023-07-04T07:25:06Z

Hey @sunjayBhatia
I would appreciate another round!

…policy Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

skriss

Thanks for the PR @shadialtarsha, still making my way through it but a couple small comments so far.

apis/projectcontour/v1/httpproxy.go

…policy Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

sunjayBhatia · 2023-07-12T17:46:13Z

internal/featuretests/v3/globalratelimit_test.go

+								},
+								Domain: "contour",
+								DefaultGlobalRateLimitPolicy: &contour_api_v1.GlobalRateLimitPolicy{
+									Descriptors: []contour_api_v1.RateLimitDescriptor{


a drawback of adding to this test this way is we have to set "Disabled" on the HTTPProxies in all the cases where we don't expect a rate limit to be set, not a huge thing but makes the test coverage a little different

Yes, unfortunately, the way these tests are written doesn't allow multiple global rate limit services to be configured easily. All HTTPProxy uses the same RLS and that is why the opted-in by default.

test/e2e/httpproxy/default_global_rate_limiting_test.go

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

internal/dag/httpproxy_processor.go

skriss · 2023-07-13T15:08:56Z

cmd/contour/serve.go

@@ -1138,6 +1140,7 @@ func (s *Server) getDAGBuilder(dbc dagBuilderConfig) *dag.Builder {
 			ConnectTimeout:                dbc.connectTimeout,
 			GlobalExternalAuthorization:   dbc.globalExternalAuthorizationService,
 			MaxRequestsPerConnection:      dbc.maxRequestsPerConnection,
+			GlobalRateLimitService:        dbc.globalRateLimitService,


xref #5458 this is another instance where we should probably apply this to at least the Ingress processor as well. I'm OK logging a follow-up issue since we don't currently support rate limiting in any way on Ingress.

Will do that, thanks for pointing this out!

internal/dag/policy.go

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

skriss

LGTM, thanks @shadialtarsha!

skriss · 2023-07-14T15:26:49Z

test/e2e/httpproxy/default_global_rate_limiting_test.go

+		// Make requests against the proxy, confirm a 429 response
+		// is now gotten since we've exceeded the rate limit.
+		res, ok := f.HTTP.RequestUntil(&e2e.HTTPRequestOpts{
+			Host:      p.Spec.VirtualHost.Fqdn,
+			Condition: e2e.HasStatusCode(429),
+		})
+		require.NotNil(t, res, "request never succeeded")
+		require.Truef(t, ok, "expected 429 response code, got %d", res.StatusCode)


It's tough to get perfect validation for these tests, but I think in combo with reviewing the code + the unit test coverage, this is sufficient for an E2E.

shadialtarsha requested a review from a team as a code owner May 15, 2023 12:20

shadialtarsha requested review from stevesloka and sunjayBhatia and removed request for a team May 15, 2023 12:20

shadialtarsha force-pushed the general-rate-limit-policy branch from 2202254 to 9275b4d Compare June 6, 2023 11:01

shadialtarsha force-pushed the general-rate-limit-policy branch 5 times, most recently from 6a8e2e6 to 5a199a5 Compare June 6, 2023 11:51

davinci26 reviewed Jun 7, 2023

View reviewed changes

internal/dag/httpproxy_processor.go Outdated Show resolved Hide resolved

internal/dag/httpproxy_processor.go Outdated Show resolved Hide resolved

internal/dag/httpproxy_processor.go Outdated Show resolved Hide resolved

shadi-altarsha added 9 commits June 9, 2023 13:41

Add support for General RateLimit Policy

a2dac6f

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

Design changes

b9f9d62

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

Add a test for default HTTPProxy

6556fba

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

Update v1 api to marshal and unmarshal yaml

29cc715

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

Add e2e tests

735f8f2

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

Add a guide to use the new API

962665a

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

Add an example

e161d16

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

Add an example

eef2f8a

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

Fix e2e testing

de0319e

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

shadialtarsha force-pushed the general-rate-limit-policy branch from 461ca91 to 0a37807 Compare June 10, 2023 13:44

shadi-altarsha added 3 commits June 10, 2023 15:52

Clean up computeVirtualHostRateLimitPolicy

ff8ac04

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

change RS domain name

5254299

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

Fix flaky tests

0b03e57

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

shadialtarsha force-pushed the general-rate-limit-policy branch from 0a37807 to 0b03e57 Compare June 10, 2023 13:52

clayton-gonsalves suggested changes Jun 19, 2023

View reviewed changes

merge main

8f1c4d9

shadi-altarsha added 3 commits June 26, 2023 12:23

Fix flaky tests

c853958

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

Fix changelog filename

5618e59

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

add more tests

530fef3

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

shadialtarsha requested review from clayton-gonsalves and davinci26 June 26, 2023 12:54

sunjayBhatia reviewed Jun 26, 2023

View reviewed changes

apis/projectcontour/v1/httpproxy.go Show resolved Hide resolved

sunjayBhatia reviewed Jun 26, 2023

View reviewed changes

changelogs/unreleased/5363-shadialtarsha-minor.md Show resolved Hide resolved

Improve changelog

cfba9e3

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

shadialtarsha requested a review from sunjayBhatia June 27, 2023 07:34

Change RateLimitService variable name

55ad4c8

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

clayton-gonsalves approved these changes Jun 28, 2023

View reviewed changes

Merge remote-tracking branch 'upstream/main' into general-rate-limit-…

4e39815

…policy Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

skriss requested changes Jul 10, 2023

View reviewed changes

apis/projectcontour/v1/httpproxy.go Outdated Show resolved Hide resolved

apis/projectcontour/v1/httpproxy.go Show resolved Hide resolved

shadi-altarsha added 2 commits July 11, 2023 11:39

Merge remote-tracking branch 'upstream/main' into general-rate-limit-…

b712271

…policy Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

Change DefaultGlobalRateLimitPolicyDisabled to Disabled

37d41de

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

shadialtarsha requested a review from skriss July 12, 2023 14:16

sunjayBhatia reviewed Jul 12, 2023

View reviewed changes

test/e2e/httpproxy/default_global_rate_limiting_test.go Outdated Show resolved Hide resolved

sunjayBhatia reviewed Jul 12, 2023

View reviewed changes

test/e2e/httpproxy/default_global_rate_limiting_test.go Outdated Show resolved Hide resolved

sunjayBhatia reviewed Jul 12, 2023

View reviewed changes

test/e2e/httpproxy/default_global_rate_limiting_test.go Outdated Show resolved Hide resolved

sunjayBhatia reviewed Jul 12, 2023

View reviewed changes

test/e2e/httpproxy/default_global_rate_limiting_test.go Outdated Show resolved Hide resolved

CR fixes

43c1205

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

shadialtarsha requested a review from sunjayBhatia July 13, 2023 11:28

skriss requested changes Jul 13, 2023

View reviewed changes

Code review fixes

6f22159

Signed-off-by: shadi-altarsha <shadi.altarsha@reddit.com>

shadialtarsha requested a review from skriss July 14, 2023 12:22

skriss approved these changes Jul 14, 2023

View reviewed changes

sunjayBhatia approved these changes Jul 14, 2023

View reviewed changes

sunjayBhatia merged commit 95f3eab into projectcontour:main Jul 14, 2023
25 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for General RateLimit Policy #5363

Add support for General RateLimit Policy #5363

shadialtarsha commented May 15, 2023 •

edited

Loading

codecov bot commented May 16, 2023 •

edited

Loading

shadialtarsha commented Jun 6, 2023

davinci26 left a comment

shadialtarsha commented Jun 10, 2023

clayton-gonsalves left a comment

shadialtarsha commented Jul 4, 2023

skriss left a comment

sunjayBhatia Jul 12, 2023

shadialtarsha Jul 13, 2023

skriss Jul 13, 2023

shadialtarsha Jul 14, 2023

skriss left a comment

skriss Jul 14, 2023

Add support for General RateLimit Policy #5363

Add support for General RateLimit Policy #5363

Conversation

shadialtarsha commented May 15, 2023 • edited Loading

codecov bot commented May 16, 2023 • edited Loading

Codecov Report

shadialtarsha commented Jun 6, 2023

davinci26 left a comment

Choose a reason for hiding this comment

shadialtarsha commented Jun 10, 2023

clayton-gonsalves left a comment

Choose a reason for hiding this comment

shadialtarsha commented Jul 4, 2023

skriss left a comment

Choose a reason for hiding this comment

sunjayBhatia Jul 12, 2023

Choose a reason for hiding this comment

shadialtarsha Jul 13, 2023

Choose a reason for hiding this comment

skriss Jul 13, 2023

Choose a reason for hiding this comment

shadialtarsha Jul 14, 2023

Choose a reason for hiding this comment

skriss left a comment

Choose a reason for hiding this comment

skriss Jul 14, 2023

Choose a reason for hiding this comment

shadialtarsha commented May 15, 2023 •

edited

Loading

codecov bot commented May 16, 2023 •

edited

Loading