For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Configure local rate limiting in ambient mesh to cap inbound request rates at waypoint proxies using Envoy’s token bucket algorithm.

Rate limiting caps the number of requests a service receives within a time window, protecting it from overload and ensuring fair resource allocation. In ambient mesh, rate limiting is applied at the waypoint proxy using Envoy’s local rate limit filter.

Local rate limiting uses a token bucket algorithm: the bucket starts full, each request consumes one token, and tokens are refilled at a fixed interval. When the bucket is empty, the waypoint returns 429 Too Many Requests without forwarding the request upstream.

Rate limiting is supported at the edge of a cluster using a gateway, or when a workload is enrolled in the waypoint layer. Learn about the different configurations required in each case.

Before you begin

1. Set up an ambient mesh in one cluster by using the Gloo Operator or Helm.

2. Label the default namespace to add it to the ambient mesh.

   kubectl label ns default istio.io/dataplane-mode=ambient

3. Create a waypoint for the default namespace. A waypoint is required because rate limiting is a Layer 7 (L7) feature. For more information on using waypoints, see Configure waypoints.

   istioctl waypoint apply -n default --enroll-namespace --wait

Deploy httpbin

1. Deploy the httpbin service and a curl client.

   kubectl apply -f https://raw.githubusercontent.com/istio/istio/1.30.3/samples/httpbin/httpbin.yaml
   kubectl apply -f https://raw.githubusercontent.com/istio/istio/1.30.3/samples/curl/curl.yaml

2. Send a test request to confirm that httpbin is reachable through the waypoint.

   kubectl exec deploy/curl -- curl -s -o /dev/null -w "%{http_code}" httpbin:8000/get

   Confirm the response is 200.

   200
   

Configure local rate limiting

Apply an EnvoyFilter to configure a local rate limit on the waypoint. The token bucket is set to 5 requests per 60 seconds, which is intentionally low to make the limit easy to trigger in this example. For production guidance on tuning these values, see the Envoy local rate limit documentation.

kubectl apply -f - <<EOF
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: httpbin-local-ratelimit
  namespace: default
spec:
  targetRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: waypoint
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: GATEWAY
      listener:
        filterChain:
          filter:
            name: "envoy.filters.network.http_connection_manager"
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.filters.http.local_ratelimit
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
          stat_prefix: http_local_rate_limiter
          token_bucket:
            max_tokens: 5
            tokens_per_fill: 5
            fill_interval: 60s
          filter_enabled:
            runtime_key: local_rate_limit_enabled
            default_value:
              numerator: 100
              denominator: HUNDRED
          filter_enforced:
            runtime_key: local_rate_limit_enforced
            default_value:
              numerator: 100
              denominator: HUNDRED
          response_headers_to_add:
          - append: false
            header:
              key: x-local-rate-limit
              value: 'true'
EOF

Test rate limiting

1. Send 10 rapid requests to httpbin and observe the response codes.

   for i in {1..10}; do
     kubectl exec deploy/curl -- curl -s -o /dev/null -w "Request $i: %{http_code}\n" httpbin:8000/get
   done

   The first 5 requests succeed with 200. Once the token bucket is empty, subsequent requests return 429.

   Request 1: 200
   Request 2: 200
   Request 3: 200
   Request 4: 200
   Request 5: 200
   Request 6: 429
   Request 7: 429
   Request 8: 429
   Request 9: 429
   Request 10: 429
   

2. Inspect the response headers on a rate-limited request. The x-local-rate-limit: true header confirms that the waypoint rejected the request before it reached httpbin.

   kubectl exec deploy/curl -- curl -sv httpbin:8000/get 2>&1 | grep -E "< HTTP|x-local"

   < HTTP/1.1 429 Too Many Requests
   < x-local-rate-limit: true
   

Cleanup

Delete the sample resources.

kubectl delete envoyfilter httpbin-local-ratelimit
kubectl delete -f https://raw.githubusercontent.com/istio/istio/1.30.3/samples/httpbin/httpbin.yaml
kubectl delete -f https://raw.githubusercontent.com/istio/istio/1.30.3/samples/curl/curl.yaml