Advanced Rate Limiting Use Cases with Envoy Proxy API and Gloo API Gateway

Slide 1

Slide 1 text

Advanced Rate Limiting with Envoy Proxy API and Gloo June 25, 2020

Slide 2

Slide 2 text

2 | Copyright © 2020 What is Rate Limiting? Goal Protect backend applications from failures caused by intentional and unintentional overloading of network traffic. Definition Rate limiting allows for setting a limit to the amount of incoming traffic an application (API) can accept for processing responses. Rate limiting allows a max number of requests over a specific time interval like per second, minute, or hour and can also have a quota. Example: 100 requests per second for service A

Slide 3

Slide 3 text

3 | Copyright © 2020 Gloo API Gateway and Ingress Controller ENVOY CONFIG CONTROL PLANE DATA PLANE END USERS Service 1 Service 2 Next Generation API Gateway • Built with Envoy Proxy • Kubernetes and Consul Native • Monolith, Microservices and Serverless Functions • Lightweight, performant, secure Service 3

Slide 4

Slide 4 text

4 | Copyright © 2020 Rate Limiting with Gloo: How does it work? EXTERNAL AUTH RATE LIMITING gRPC TRANSCODER ROUTER UPSTREAM EXTERNAL AUTH SERVER RATE LIMITING SERVER DATA PLANE CONTROL PLANE ENVOY PROXY FILTERS CONFIGS IN GLOO

Slide 5

Slide 5 text

Slide 6

Slide 6 text

6 | Copyright © 2020 Use Case: Multiple Rate Limits Per Client ID Granular control to protect against unplanned bursts in traffic • Define by remote_address • Use real client ID, not Kubernetes cluster or load balancer address • Configure one or multiple rate limits • Nested rate limits spec: ratelimit: descriptors: - key: generic_key value: "per-minute" descriptors: - key: remote_address rateLimit: requestsPerUnit: 20 unit: MINUTE - key: generic_key value: "per-second" descriptors: - key: remote_address rateLimit: requestsPerUnit: 2 unit: SECOND

Slide 7

Slide 7 text

7 | Copyright © 2020 Use Case: Rate Limit Prioritization by HTTP Method Guarantee high priority traffic when multiple types of requests enter a given service • Define a limit per request type • Critical request will be processed before the lower priority request • Service will never be overloaded by volume of lower priority requests spec: ratelimit: descriptors: # allow 5 calls per minute for any unique host - key: remote_address rateLimit: requestsPerUnit: 5 unit: MINUTE # specifically limit GET requests from unique hosts to 2 per min - key: method value: GET descriptors: - key: remote_address rateLimit: requestsPerUnit: 2 unit: MINUTE

Slide 8

Slide 8 text

8 | Copyright © 2020 Use Case: Integrate Rate Limiting with JWT Integrating additional security policies • Further protect services • Add JWT configuration above the rate limit configuration in the yml file • JWT token must be verified prior to passing through rate limit filter options: jwt providers: solo: tokenSource: headers: - header: x-token queryParams: - token claimsToHeaders: - claim: type header: x-type - claim: number header: x-number issuer: solo.io jwks: local: key: | -----BEGIN PUBLIC KEY-----