istio - Istio1.9 中的限速功能实现

Question

我已经完成了 Istio 1.9 的初始设置并部署了 bookInfo 应用程序来复制 Istio 站点中提供的示例以进行速率限制。因为我们的应用程序中有用例来实现速率限制。我将项目 Istio 作为解决方案，但在运行 Istio 官方链接中提供的 yaml 时我面临挑战。

有人可以帮我吗？
https://istio.io/latest/docs/tasks/policy-enforcement/rate-limit/
我已经部署了来自 following link 的 bookinfo 示例
YAML 特使

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: filter-ratelimit
  namespace: istio-system
spec:
  workloadSelector:
    # select by label in the same namespace
    labels:
      istio: ingressgateway
  configPatches:
    # The Envoy config you want to modify
    - applyTo: HTTP_FILTER
      match:
        context: GATEWAY
        listener:
          filterChain:
            filter:
              name: "envoy.filters.network.http_connection_manager"
              subFilter:
                name: "envoy.filters.http.router"
      patch:
        operation: INSERT_BEFORE
        # Adds the Envoy Rate Limit Filter in HTTP filter chain.
        value:
          name: envoy.filters.http.ratelimit
          typed_config:
            "@type": type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
            # domain can be anything! Match it to the ratelimter service config
            domain: productpage-ratelimit
            failure_mode_deny: true
            rate_limit_service:
              grpc_service:
                envoy_grpc:
                  cluster_name: rate_limit_cluster
                timeout: 10s
              transport_api_version: V3
    - applyTo: CLUSTER
      match:
        cluster:
          service: ratelimit.default.svc.cluster.local
      patch:
        operation: ADD
        # Adds the rate limit service cluster for rate limit service defined in step 1.
        value:
          name: rate_limit_cluster
          type: STRICT_DNS
          connect_timeout: 10s
          lb_policy: ROUND_ROBIN
          http2_protocol_options: {}
          load_assignment:
            cluster_name: rate_limit_cluster
            endpoints:
            - lb_endpoints:
              - endpoint:
                  address:
                     socket_address:
                      address: ratelimit.default.svc.cluster.local
                      port_value: 8081

应用特使 yaml 时出错:

Error from server: error when creating "envoyfilter.yaml": admission webhook "validation.istio.io" denied the request: configuration is invalid: Envoy filter: subfilter match requires filter match with envoy.http_connection_manager

Answer 1

正如之前评论中怀疑的那样，该问题是由于使用了旧版本的 Istio (1.7) 而不是预期的 1.9。老版本还在期待the deprecated filer names :

envoy.http_connection_manager而不是 envoy.filters.network.http_connection_manager

envoy.router而不是 envoy.filters.http.router

Access Logger, Listener Filter, HTTP Filter, Network Filter, StatsSink, and Tracer names have been deprecated in favor of the extensionname from the envoy build system.

在分析您的问题时，我偶然发现了几个很好的资源，您会在学习过程中发现它们很有用:

Docs regarding the filters you plan to use

Understanding Envoy Filters

Extending Istio with the EnvoyFilter CRD

当然还有 Istio docs