Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Rate Limit using Istio Envoy #674

Merged
merged 5 commits into from
Dec 1, 2023

Conversation

joonhyukchoi
Copy link
Contributor

@joonhyukchoi joonhyukchoi commented Nov 10, 2023

What this PR does / why we need it:
To limit a large number of requests, such as in a DDoS attack, we can use Istio(envoy)'s rate limit in K8s ingress.
Which issue(s) this PR fixes:

Fixes #590

Special notes for your reviewer:
I have tested on local K8s environment with yorkie-cluster Helm chart with minikube, and it worked as expected.
Does this PR introduce a user-facing change?:


Additional documentation:


Checklist:

  • Added relevant tests or not required
  • Didn't break anything

Copy link

codecov bot commented Nov 10, 2023

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (5500afb) 48.96% compared to head (49d0686) 48.81%.
Report is 3 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #674      +/-   ##
==========================================
- Coverage   48.96%   48.81%   -0.15%     
==========================================
  Files          69       69              
  Lines       10090    10127      +37     
==========================================
+ Hits         4941     4944       +3     
- Misses       4631     4657      +26     
- Partials      518      526       +8     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@krapie krapie self-requested a review November 10, 2023 17:25
@krapie krapie added the enhancement 🌟 New feature or request label Nov 11, 2023
Copy link
Member

@krapie krapie left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for your contribution.
I think it will be good to have the opportunity to demonstrate and explain this feature (on weekly sync or personal meeting).

Leaving two major suggestions below:

  1. Since we have many manifests in single directory templates, how about seperating manifests for each service by directory like below?
- templates
  - yorkie
    - deployment.yaml
  - istio
    - ingress.yaml
    - ratelimit.yaml
  1. How about adding enable/disable value in values.yaml to enable and disable rate limiting base on their needs?
ratelimit:
  enabled: false

Copy link
Member

@krapie krapie left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for applying my feedbacks.
I left few more comments below.

How about setting requestsPerUnit to 10000 for now?

Considering total request metric in #590 and total request metric of this month(2023.11.01 ~ 2023.11.23), I think setting 10000 requests per minute will do.

image
(total request metric of #590, approximately 10000+ per minute)

image2
(highest total request metric between 2023.11.01 and 2023.11.23, approximately 8000- per minute)

@krapie
Copy link
Member

krapie commented Nov 27, 2023

@joonhyukchoi After you finish your revision, please re-request review for further progress.

@krapie krapie self-requested a review November 30, 2023 02:22
Copy link
Member

@krapie krapie left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! It works perfectly!

FYI, I could not find references that global rate limit is done per source ip (seems like it is default setting in global rate limit). For local rate limit, we can use remote_address key to rate limit per source ip. So we need to check if global rate limit works per source ip after we apply this changes in our cluster.

@krapie krapie merged commit 12e86a2 into yorkie-team:main Dec 1, 2023
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement 🌟 New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

JS SDK v0.4.5 causing excessive WatchDocument requests and server v0.4.4 instability
2 participants