Istio - rate limit with xDS based configuration loading

[rajakumar17]

I have tried rate limit with Istio Ingressgateway as documented. This works well, however the rate limit service config is persisted as a ConfigMap and provided to the rate limit service using file based loading.

Rate limit service also has a provision to load the config using xDS. To perform this loading, need to set the xDS server URL to the rate limit service.

Can I use istiod as xDS server for the rate limit service? How to do this, if this is feasible. I do not see any documentation on this.
I also do not see any istio namespaced CRs which can take in the rate limit service config.

[zirain]

istio only support it via EnvoyFilter, doc is here: https://istio.io/latest/docs/tasks/policy-enforcement/rate-limit/

there're some proposal about RateLimit, but all of them didn't make an agreement.

[rajakumar17]

Yes, I agree that the ratelimit filter configuration and rate limit actions are done using EnvoyFilter. I am looking at ways to dynamically update the rate limit service config which is ConfigMap/file based now.

$ kubectl apply -f - <<EOF apiVersion: v1 kind: ConfigMap metadata: name: ratelimit-config data: config.yaml: | domain: productpage-ratelimit descriptors: - key: PATH value: "/productpage" rate_limit: unit: minute requests_per_unit: 1 - key: PATH rate_limit: unit: minute requests_per_unit: 100 EOF

This config needs to be updated to the rate limit service via xDS (istiod). Can you share if there is a proposal or alternative way to achieving this?

https://github.com/envoyproxy/ratelimit#xds-management-server-based-configuration-loading
How to set xds based rate limit service config loading while using Isito?

[zirain]

istio cannot do that, you should manage it yourself.