Add support for General RateLimit Policy

apis/projectcontour/v1/httpproxy.go

@@ -815,45 +815,50 @@ type LocalRateLimitPolicy struct {
 
 // GlobalRateLimitPolicy defines global rate limiting parameters.
 type GlobalRateLimitPolicy struct {
+	// DefaultGlobalRateLimitPolicyDisabled configures the HTTPProxy to not use
+	// the default global rate limit policy defined by the Contour configuration.
+	// +optional
+	DefaultGlobalRateLimitPolicyDisabled bool `json:"defaultGlobalRateLimitPolicyDisabled,omitempty"`
+
 	// Descriptors defines the list of descriptors that will
 	// be generated and sent to the rate limit service. Each
 	// descriptor contains 1+ key-value pair entries.
-	// +required
+	// +optional
 	// +kubebuilder:validation:MinItems=1
-	Descriptors []RateLimitDescriptor `json:"descriptors,omitempty"`
+	Descriptors []RateLimitDescriptor `json:"descriptors,omitempty" yaml:"descriptors,omitempty"`
 }
 
 // RateLimitDescriptor defines a list of key-value pair generators.
 type RateLimitDescriptor struct {
 	// Entries is the list of key-value pair generators.
 	// +required
 	// +kubebuilder:validation:MinItems=1
-	Entries []RateLimitDescriptorEntry `json:"entries,omitempty"`
+	Entries []RateLimitDescriptorEntry `json:"entries,omitempty" yaml:"entries,omitempty"`
 }
 
 // RateLimitDescriptorEntry is a key-value pair generator. Exactly
 // one field on this struct must be non-nil.
 type RateLimitDescriptorEntry struct {
 	// GenericKey defines a descriptor entry with a static key and value.
 	// +optional
-	GenericKey *GenericKeyDescriptor `json:"genericKey,omitempty"`
+	GenericKey *GenericKeyDescriptor `json:"genericKey,omitempty" yaml:"genericKey,omitempty"`
 
 	// RequestHeader defines a descriptor entry that's populated only if
 	// a given header is present on the request. The descriptor key is static,
 	// and the descriptor value is equal to the value of the header.
 	// +optional
-	RequestHeader *RequestHeaderDescriptor `json:"requestHeader,omitempty"`
+	RequestHeader *RequestHeaderDescriptor `json:"requestHeader,omitempty" yaml:"requestHeader,omitempty"`
 
 	// RequestHeaderValueMatch defines a descriptor entry that's populated
 	// if the request's headers match a set of 1+ match criteria. The
 	// descriptor key is "header_match", and the descriptor value is static.
 	// +optional
-	RequestHeaderValueMatch *RequestHeaderValueMatchDescriptor `json:"requestHeaderValueMatch,omitempty"`
+	RequestHeaderValueMatch *RequestHeaderValueMatchDescriptor `json:"requestHeaderValueMatch,omitempty" yaml:"requestHeaderValueMatch,omitempty"`
 
 	// RemoteAddress defines a descriptor entry with a key of "remote_address"
 	// and a value equal to the client's IP address (from x-forwarded-for).
 	// +optional
-	RemoteAddress *RemoteAddressDescriptor `json:"remoteAddress,omitempty"`
+	RemoteAddress *RemoteAddressDescriptor `json:"remoteAddress,omitempty" yaml:"remoteAddress,omitempty"`
 }
 
 // GenericKeyDescriptor defines a descriptor entry with a static key and
@@ -862,12 +867,12 @@ type GenericKeyDescriptor struct {
 	// Key defines the key of the descriptor entry. If not set, the
 	// key is set to "generic_key".
 	// +optional
-	Key string `json:"key,omitempty"`
+	Key string `json:"key,omitempty" yaml:"key,omitempty"`
 
 	// Value defines the value of the descriptor entry.
 	// +required
 	// +kubebuilder:validation:MinLength=1
-	Value string `json:"value,omitempty"`
+	Value string `json:"value,omitempty" yaml:"value,omitempty"`
 }
 
 // RequestHeaderDescriptor defines a descriptor entry that's populated only
@@ -877,12 +882,12 @@ type RequestHeaderDescriptor struct {
 	// HeaderName defines the name of the header to look for on the request.
 	// +required
 	// +kubebuilder:validation:MinLength=1
-	HeaderName string `json:"headerName,omitempty"`
+	HeaderName string `json:"headerName,omitempty" yaml:"headerName,omitempty"`
 
 	// DescriptorKey defines the key to use on the descriptor entry.
 	// +required
 	// +kubebuilder:validation:MinLength=1
-	DescriptorKey string `json:"descriptorKey,omitempty"`
+	DescriptorKey string `json:"descriptorKey,omitempty" yaml:"descriptorKey,omitempty"`
 }
 
 // RequestHeaderValueMatchDescriptor defines a descriptor entry that's populated
@@ -892,19 +897,19 @@ type RequestHeaderValueMatchDescriptor struct {
 	// Headers is a list of 1+ match criteria to apply against the request
 	// to determine whether to populate the descriptor entry or not.
 	// +kubebuilder:validation:MinItems=1
-	Headers []HeaderMatchCondition `json:"headers,omitempty"`
+	Headers []HeaderMatchCondition `json:"headers,omitempty" yaml:"headers,omitempty"`
 
 	// ExpectMatch defines whether the request must positively match the match
 	// criteria in order to generate a descriptor entry (i.e. true), or not
 	// match the match criteria in order to generate a descriptor entry (i.e. false).
 	// The default is true.
 	// +kubebuilder:default=true
-	ExpectMatch bool `json:"expectMatch,omitempty"`
+	ExpectMatch bool `json:"expectMatch,omitempty" yaml:"expectMatch,omitempty"`
 
 	// Value defines the value of the descriptor entry.
 	// +required
 	// +kubebuilder:validation:MinLength=1
-	Value string `json:"value,omitempty"`
+	Value string `json:"value,omitempty" yaml:"value,omitempty"`
 }
 
 // RemoteAddressDescriptor defines a descriptor entry with a key of

apis/projectcontour/v1alpha1/contourconfig.go

@@ -660,6 +660,12 @@ type RateLimitServiceConfig struct {
 	//
 	// +optional
 	EnableResourceExhaustedCode *bool `json:"enableResourceExhaustedCode,omitempty"`
+
+	// DefaultGlobalRateLimitPolicy allows setting a default global rate limit policy for every HTTPProxy.
+	// HTTPProxy can overwrite this configuration.
+	//
+	// +optional
+	DefaultGlobalRateLimitPolicy *contour_api_v1.GlobalRateLimitPolicy `json:"defaultGlobalRateLimitPolicy,omitempty"`
 }
 
 // TracingConfig defines properties for exporting trace data to OpenTelemetry.

cmd/contour/serve.go

@@ -515,6 +515,7 @@
 		httpsAddress:                       contourConfiguration.Envoy.HTTPSListener.Address,
 		httpsPort:                          contourConfiguration.Envoy.HTTPSListener.Port,
 		globalExternalAuthorizationService: contourConfiguration.GlobalExternalAuthorization,
+		globalRateLimitService:             contourConfiguration.RateLimitService,
 	})
 
 	// Build the core Kubernetes event handler.
@@ -1037,6 +1038,7 @@
 	httpsAddress                       string
 	httpsPort                          int
 	globalExternalAuthorizationService *contour_api_v1.AuthorizationServer
+	globalRateLimitService             *contour_api_v1alpha1.RateLimitServiceConfig
 }
 
 func (s *Server) getDAGBuilder(dbc dagBuilderConfig) *dag.Builder {
@@ -1122,6 +1124,7 @@
 			ResponseHeadersPolicy:       &responseHeadersPolicy,
 			ConnectTimeout:              dbc.connectTimeout,
 			GlobalExternalAuthorization: dbc.globalExternalAuthorizationService,
+			RateLimitService:            dbc.globalRateLimitService,
 		},
 	}
 

cmd/contour/servecontext.go

@@ -414,10 +414,11 @@ func (ctx *serveContext) convertToContourConfigurationSpec() contour_api_v1alpha
 				Name:      nsedName.Name,
 				Namespace: nsedName.Namespace,
 			},
-			Domain:                      ctx.Config.RateLimitService.Domain,
-			FailOpen:                    ref.To(ctx.Config.RateLimitService.FailOpen),
-			EnableXRateLimitHeaders:     ref.To(ctx.Config.RateLimitService.EnableXRateLimitHeaders),
-			EnableResourceExhaustedCode: ref.To(ctx.Config.RateLimitService.EnableResourceExhaustedCode),
+			Domain:                       ctx.Config.RateLimitService.Domain,
+			FailOpen:                     ref.To(ctx.Config.RateLimitService.FailOpen),
+			EnableXRateLimitHeaders:      ref.To(ctx.Config.RateLimitService.EnableXRateLimitHeaders),
+			EnableResourceExhaustedCode:  ref.To(ctx.Config.RateLimitService.EnableResourceExhaustedCode),
+			DefaultGlobalRateLimitPolicy: ctx.Config.RateLimitService.DefaultGlobalRateLimitPolicy,
 		}
 	}
 

cmd/contour/servecontext_test.go

@@ -629,6 +629,20 @@ func TestConvertServeContext(t *testing.T) {
 					FailOpen:                    true,
 					EnableXRateLimitHeaders:     true,
 					EnableResourceExhaustedCode: true,
+					DefaultGlobalRateLimitPolicy: &contour_api_v1.GlobalRateLimitPolicy{
+						Descriptors: []contour_api_v1.RateLimitDescriptor{
+							{
+								Entries: []contour_api_v1.RateLimitDescriptorEntry{
+									{
+										GenericKey: &contour_api_v1.GenericKeyDescriptor{
+											Key:   "foo",
+											Value: "bar",
+										},
+									},
+								},
+							},
+						},
+					},
 				}
 				return ctx
 			},
@@ -642,6 +656,20 @@ func TestConvertServeContext(t *testing.T) {
 					FailOpen:                    ref.To(true),
 					EnableXRateLimitHeaders:     ref.To(true),
 					EnableResourceExhaustedCode: ref.To(true),
+					DefaultGlobalRateLimitPolicy: &contour_api_v1.GlobalRateLimitPolicy{
+						Descriptors: []contour_api_v1.RateLimitDescriptor{
+							{
+								Entries: []contour_api_v1.RateLimitDescriptorEntry{
+									{
+										GenericKey: &contour_api_v1.GenericKeyDescriptor{
+											Key:   "foo",
+											Value: "bar",
+										},
+									},
+								},
+							},
+						},
+					},
 				}
 				return cfg
 			},

design/default-global-rate-limit-policy.md

@@ -1,6 +1,6 @@
 # Default Global RateLimit Policy
 
-Status: Reviewing
+Status: Accepted
 
 ## Abstract
 Define a default global rate limit policy in the Contour configuration to be used as a global rate limit policy by all HTTPProxy objects.