Question

我正在扩展Istio以提供Thrift功能。我现在正在使用的Istio组件是Pilot（Envoy配置服务）。我使用基本的Thrift路由对其进行了扩展，以便它可以提供Envoy配置，以将侦听器路由到正确的集群。我的开发环境如下：

现在，我正在尝试添加速率限制。我正在关注the docs。由于没有速率限制过滤器，因此我为配置配置了一个RouteAction，但未应用。这样可以正常工作，并像以前一样通过流量：

...
       {
        "filters": [
         {
          "name": "envoy.filters.network.thrift_proxy",
          "typed_config": {
           "@type": "type.googleapis.com/envoy.config.filter.network.thrift_proxy.v2alpha1.ThriftProxy",
           "stat_prefix": "10.97.28.169_9090",
           "transport": "HEADER",
           "protocol": "BINARY",
           "route_config": {
            "name": "outbound|9090||backend.default.svc.cluster.local",
            "routes": [
             {
              "match": {
               "method_name": ""
              },
              "route": {
               "cluster": "outbound|9090||backend.default.svc.cluster.local",
               "rate_limits": [
                {
                 "actions": [
                  {
                   "request_headers": {
                    "header_name": ":method-name",
                    "descriptor_key": "method-name"
                   }
                  }
                 ]
                }
               ]
              }
             }
            ]
           }
          }
         }
        ]
       }
      ],
      "deprecated_v1": {
       "bind_to_port": false
      },
      "listener_filters_timeout": "0.100s",
      "traffic_direction": "OUTBOUND",
      "continue_on_listener_filters_timeout": true
     },
     "last_updated": "2019-10-30T16:26:39.203Z"
    },
...

我已经构建了一个函数来创建envoy.filters.thrift.rate_limit过滤器，该过滤器使Envoy调用我设置的速率限制服务（我已经尝试过GoogleGrpc和EnvoyGrpc）：

func buildThriftRatelimit(ratelimitServiceUri, domain string) *thrift_ratelimit.RateLimit {
    var thriftRateLimit  *thrift_ratelimit.RateLimit
    timeout := 2000 * time.Millisecond

    thriftRateLimit = &thrift_ratelimit.RateLimit{
        Domain: domain,
        Timeout: &timeout,
        FailureModeDeny: false,
        RateLimitService: &ratelimit.RateLimitServiceConfig{
            GrpcService: &core.GrpcService{
                TargetSpecifier: &core.GrpcService_GoogleGrpc_{
                    GoogleGrpc: &core.GrpcService_GoogleGrpc{
                        StatPrefix: ratelimitServiceUri,
                        TargetUri:  ratelimitServiceUri,
                    },
                },
            },
        },
    }

    thriftRateLimit.Validate()
    if err := thriftRateLimit.Validate(); err != nil {
        panic(err)
    }

    return thriftRateLimit
}

哪个会产生：

...
       {
        "filters": [
         {
          "name": "envoy.filters.network.thrift_proxy",
          "typed_config": {
           "@type": "type.googleapis.com/envoy.config.filter.network.thrift_proxy.v2alpha1.ThriftProxy",
           "stat_prefix": "10.97.28.169_9090",
           "transport": "HEADER",
           "protocol": "BINARY",
           "route_config": {
            "name": "outbound|9090||backend.default.svc.cluster.local",
            "routes": [
             {
              "match": {
               "method_name": ""
              },
              "route": {
               "cluster": "outbound|9090||backend.default.svc.cluster.local",
               "rate_limits": [
                {
                 "actions": [
                  {
                   "request_headers": {
                    "header_name": ":method-name",
                    "descriptor_key": "method-name"
                   }
                  }
                 ]
                }
               ]
              }
             }
            ]
           },
           "thrift_filters": [
            {
             "name": "envoy.filters.thrift.rate_limit",
             "typed_config": {
              "@type": "type.googleapis.com/envoy.config.filter.thrift.rate_limit.v2alpha1.RateLimit",
              "domain": "backend.default.svc.cluster.local",
              "timeout": "2s",
              "rate_limit_service": {
               "grpc_service": {
                "google_grpc": {
                 "target_uri": "istio-lyft-ratelimit.istio-system.svc.cluster.local:80",
                 "stat_prefix": "istio-lyft-ratelimit.istio-system.svc.cluster.local:80"
                }
               }
              }
             }
            }
           ]
          }
         }
        ]
       }
      ],
      "deprecated_v1": {
       "bind_to_port": false
      },
      "listener_filters_timeout": "0.100s",
      "traffic_direction": "OUTBOUND",
      "continue_on_listener_filters_timeout": true
     },
     "last_updated": "2019-10-30T16:26:39.203Z"
    },
...

应用速率限制过滤器后，与后端的连接消失，没有错误返回给客户端或显示在Envoy的日志中。

Answer 1

如果提供了Thrift过滤器，则需要将Router过滤器添加为链中的最后一个过滤器，如下所示：

...
       {
        "filters": [
         {
          "name": "envoy.filters.network.thrift_proxy",
          "typed_config": {
           "@type": "type.googleapis.com/envoy.config.filter.network.thrift_proxy.v2alpha1.ThriftProxy",
           "stat_prefix": "10.97.28.169_9090",
           "transport": "HEADER",
           "protocol": "BINARY",
           "route_config": {
            "name": "outbound|9090||backend.default.svc.cluster.local",
            "routes": [
             {
              "match": {
               "method_name": ""
              },
              "route": {
               "cluster": "outbound|9090||backend.default.svc.cluster.local",
               "rate_limits": [
                {
                 "actions": [
                  {
                   "request_headers": {
                    "header_name": ":method-name",
                    "descriptor_key": "method-name"
                   }
                  }
                 ]
                }
               ]
              }
             }
            ]
           },
           "thrift_filters": [
            {
             "name": "envoy.filters.thrift.rate_limit",
             "typed_config": {
              "@type": "type.googleapis.com/envoy.config.filter.thrift.rate_limit.v2alpha1.RateLimit",
              "domain": "backend.default.svc.cluster.local",
              "timeout": "2s",
              "rate_limit_service": {
               "grpc_service": {
                "google_grpc": {
                 "target_uri": "istio-lyft-ratelimit.istio-system.svc.cluster.local:80",
                 "stat_prefix": "istio-lyft-ratelimit.istio-system.svc.cluster.local:80"
                }
               }
              }
             }
            },
            {
             "name": "envoy.filters.thrift.router"
            }
           ]
          }
         }
        ]
       }
      ],
      "deprecated_v1": {
       "bind_to_port": false
      },
      "listener_filters_timeout": "0.100s",
      "traffic_direction": "OUTBOUND",
      "continue_on_listener_filters_timeout": true
     },
     "last_updated": "2019-10-30T16:26:39.203Z"
    },
...

特使节俭限制

1 个答案: