[Bug]: Referencing the same RateLimiting Policy on multiple locations in the same VirtualServer #7401

shaun-nx · 2025-02-17T16:27:04Z

shaun-nx
Feb 17, 2025
Collaborator

Overview

Hi folks!

This discussion was originally posted as a bug, but this has been converted to a discussion to allow this use case to be openly discussed.
The use case here is, ensuring that teach route that references the same rateLimit Policy has their own Rate Limit Request Zone.
In the current implementation, a Rate Limit Request Zone is created for each Policy deployed, rater than for each reference to that policy.

Steps to reproduce

Actual Behaviour

I have a VirtualServer with 3 routes:

/coffee with a basic rate-limit policy applied
/tea with a basic rate-limit policy applied
/global-rate which has no policy applied, as I want any number of requests to hit this endpoint

With this setup, if /coffee is being hit by more than 1 request per-second, any request to /tea will return a 503.
In order to get around this, I would need to create a separate, identical policy with the same rate limit settings.
This is because the rate limit zones is tied to the Policy itself and not the location that it is supplied to.

Here is an example of the YAML files I am using:

Policy:

apiVersion: k8s.nginx.org/v1
kind: Policy
metadata:
  name: rate-limit-policy
spec:
  rateLimit:
    rate: 1r/s
    key: ${binary_remote_addr}
    zoneSize: 10M

VirtualServer:

apiVersion: k8s.nginx.org/v1
kind: VirtualServer
metadata:
  name: webapp
spec:
  host: webapp.example.com
  upstreams:
  - name: webapp
    service: webapp-svc
    port: 80
  routes:
  - path: /coffee
    action:
      pass: webapp
    policies:
      - name: rate-limit
  - path: /tea
    action:
      pass: webapp
   policies:
   - name: rate-limit
  - path: /unlimited
    action:
      pass: webapp

The below command will send a request and sleep for 1 second. This is to simulate the behaviour

while [ 1 ]; do curl --resolve webapp.example.com:8080:127.0.0.1 http://webapp.example.com:8080/coffee; sleep 1; done

If a request is sent to /tea while this loop is running, the endpoint will return 503

curl --resolve webapp.example.com:8080:127.0.0.1 http://webapp.example.com:8080/tea
<html>
<head><title>503 Service Temporarily Unavailable</title></head>
<body>
<center><h1>503 Service Temporarily Unavailable</h1></center>
<hr><center>nginx/1.27.3</center>
</body>
</html>

If I hit the /unlimited endpoint, it will work fine since there is no policy attached:

curl --resolve webapp.example.com:8080:127.0.0.1 http://webapp.example.com:8080/unlimited
Server address: 10.42.0.68:8080
Server name: webapp-8598df94db-6ktq7
Date: 17/Feb/2025:16:25:00 +0000
URI: /unlimited
Request ID: f14399aeec2fdf09198573a6b9b7e298

Expected behaviour

I would expect /coffee and /tea to both have independent rate limiting.
As it is, if one endpoint is overwhelemd, all other endpoints using the same policy will be unavailable

@shaun-nx · 2025-02-17T16:27:18Z

github-actions[bot]
bot Feb 17, 2025

Hi @shaun-nx thanks for reporting!

Be sure to check out the docs and the Contributing Guidelines while you wait for a human to take a look at this 🙂

Cheers!

0 replies

jjngx · 2025-02-24T16:37:30Z

jjngx
Feb 24, 2025
Collaborator

@shaun-nx todo: add comments

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Bug]: Referencing the same RateLimiting Policy on multiple locations in the same VirtualServer #7401

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments

{{title}}

{{title}}

Select a reply

[Bug]: Referencing the same RateLimiting Policy on multiple locations in the same VirtualServer #7401

shaun-nx Feb 17, 2025 Collaborator

Overview

Steps to reproduce

Actual Behaviour

Expected behaviour

Replies: 2 comments

github-actions[bot] bot Feb 17, 2025

jjngx Feb 24, 2025 Collaborator

shaun-nx
Feb 17, 2025
Collaborator

github-actions[bot]
bot Feb 17, 2025

jjngx
Feb 24, 2025
Collaborator