Istio网关Local Rate Limiter多Pod不同步及路径限流咨询

尝试通过Istio的EnvoyFilter实现仅对特定路径前缀（如"/api/serviceA/v1/*"）生效的HTTP限流，当前在GATEWAY上下文部署的EnvoyFilter存在两个核心问题：

1. 多个网关Pod间限流策略不同步，Pod扩缩容时总限流阈值随Pod数量动态增加
2. LocalRateLimit的descriptors仅支持匹配具体路径，无法实现路径前缀匹配

需求方向：

• 无需部署第三方服务，实现网关Pod间的限流同步
• 或直接在服务Sidecar的SIDECAR_INBOUND上下文，针对特定路径前缀实施限流

当前存在问题的EnvoyFilter配置：

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: gw-rate-limiter
spec:
  workloadSelector:
    labels:
      istio: istio-igw
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: GATEWAY
        listener:
          filterChain:
            filter:
              name: 'envoy.filters.network.http_connection_manager'
              subFilter:
                name: 'envoy.filters.http.router'
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.local_ratelimit
          typed_config:
            "@type": type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
            value:
              stat_prefix: http_local_rate_limiter
    - applyTo: HTTP_ROUTE
      match:
        context: GATEWAY
        routeConfiguration:
          vhost:
            name: "some.domain.com:443" # virtual host name
            route:
              name: "my-named-api-route" # route name inside virtual host
              action: "ANY"
      patch:
        operation: MERGE
        value:
          typed_per_filter_config:
            envoy.filters.http.local_ratelimit:
              "@type": type.googleapis.com/udpa.type.v1.TypedStruct
              type_url: type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
              value:
                stat_prefix: http_local_rate_limiter
                token_bucket:
                  max_tokens: 5
                  tokens_per_fill: 5
                  fill_interval: 30s
                filter_enabled:
                  runtime_key: local_rate_limit_enabled
                  default_value:
                    numerator: 100
                    denominator: HUNDRED
                filter_enforced:
                  runtime_key: local_rate_limit_enforced
                  default_value:
                    numerator: 100
                    denominator: HUNDRED
                response_headers_to_add:
                  - append: true
                    header:
                      key: x-local-rate-limit
                      value: 'true'

一、Sidecar层针对路径前缀的独立限流（推荐） #

此方案直接在服务Sidecar上配置，每个Pod独立执行限流规则，无需跨Pod同步，且可精准匹配路径前缀，完全满足需求：

1. 路径前缀匹配的核心配置 #

Envoy的LocalRateLimit支持通过descriptors结合prefix_match: true实现路径前缀匹配，修正之前的配置缺陷。

2. 完整的Sidecar EnvoyFilter配置 #

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: sidecar-serviceA-ratelimit
  namespace: your-service-namespace # 替换为服务所在命名空间
spec:
  workloadSelector:
    labels:
      app: serviceA # 替换为服务的Pod标签
  configPatches:
    # 1. 插入LocalRateLimit过滤器到Sidecar入链HTTP过滤器链
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_INBOUND
        listener:
          filterChain:
            filter:
              name: 'envoy.filters.network.http_connection_manager'
              subFilter:
                name: 'envoy.filters.http.router'
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.local_ratelimit
          typed_config:
            "@type": type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
            value:
              stat_prefix: http_local_rate_limiter
              token_bucket:
                max_tokens: 10 # 单个Pod的限流阈值
                tokens_per_fill: 10
                fill_interval: 60s
              filter_enabled:
                runtime_key: local_rate_limit_enabled
                default_value:
                  numerator: 100
                  denominator: HUNDRED
              filter_enforced:
                runtime_key: local_rate_limit_enforced
                default_value:
                  numerator: 100
                  denominator: HUNDRED
              response_headers_to_add:
                - append: true
                  header:
                    key: x-local-rate-limit
                    value: 'true'
              # 配置路径前缀匹配规则
              descriptors:
                - entries:
                    - key: path
                      value: "/api/serviceA/v1/"
                      prefix_match: true # 启用前缀匹配，覆盖所有以该路径开头的请求

    # 2. 在Sidecar路由配置中启用LocalRateLimit
    - applyTo: HTTP_ROUTE
      match:
        context: SIDECAR_INBOUND
        routeConfiguration:
          vhost:
            name: "inbound|http|8080" # 替换为服务的端口，格式为inbound|协议|端口号
            route:
              action: "ANY"
      patch:
        operation: MERGE
        value:
          typed_per_filter_config:
            envoy.filters.http.local_ratelimit:
              "@type": type.googleapis.com/udpa.type.v1.TypedStruct
              type_url: type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
              value:
                stat_prefix: http_local_rate_limiter
                filter_enabled:
                  runtime_key: local_rate_limit_enabled
                  default_value:
                    numerator: 100
                    denominator: HUNDRED
                filter_enforced:
                  runtime_key: local_rate_limit_enforced
                  default_value:
                    numerator: 100
                    denominator: HUNDRED

3. 配置说明 #

• workloadSelector：精准定位到目标服务的Sidecar Pod
• prefix_match: true：实现路径前缀匹配，覆盖所有以/api/serviceA/v1/开头的请求
• 每个服务Pod独立执行限流，总限流阈值为单个Pod阈值 × Pod数量，若需固定总阈值，可结合HPA根据请求量动态调整Pod数量

二、网关层无第三方服务的近似全局限流 #

若必须在网关层实现跨Pod的限流同步，无需第三方服务的前提下，可采用以下两种近似方案：

1. 基于预期Pod数分配阈值 #

预先计算全局总限流阈值，将每个网关Pod的限流阈值设置为总阈值 ÷ 预期最大Pod数，同时：

• 在过滤器配置中添加enable_x_ratelimit_headers: true，暴露当前限流状态
• 结合HPA基于请求量扩缩容，通过Istio Runtime Config动态调整每个Pod的阈值（可通过Kubernetes Operator自动化实现）

2. 同一节点内的共享内存限流 #

若网关Pod均部署在同一节点，可配置Envoy的LocalRateLimit使用共享内存实现节点内同步：
在过滤器的typed_config.value中添加：

share_key: "gateway_global_rate_limit"
enable_shadow_mode: false

注意：此方案仅适用于同一节点内的Pod，跨节点无法同步。

内容的提问来源于stack exchange，提问作者kpodgorski