Envoy Global Rate Limit Service not hit

[Dominik Winter]

Hi,

I wrote a simple Rate Limit gRPC Service in Rust which implements the should_rate_limit function which is called by envoy for making rate limit decisions.

I also configured envoy to use this serivce, but it is never called.

However in the envoy logs I see the following:

timestamp="2023-08-02 08:28:52.691" log_level=trace logger=http source=source/common/http/filter_manager.cc:1343 message="[Tags: \"ConnectionId\":\"41\",\"StreamId\":\"10740350797516840797\"] encode data called: filter=envoy.filters.http.ratelimit status=0"
timestamp="2023-08-02 08:29:12.140" log_level=trace logger=http source=source/common/http/filter_manager.cc:539 message="[Tags: \"ConnectionId\":\"41\",\"StreamId\":\"12438371875489985164\"] decode headers called: filter=envoy.filters.http.ratelimit status=0"

As the request gets proxied to the upstream cluster, even with failure_mode_deny set to true, I don't now how I can further debug the problem.

Any help is highly appreciated!

Here are the important parts of the configuration:

route_config:

virtual_hosts:

- name: default

domains: ["*"]

routes:

- match: { prefix: "/" }

route:

cluster: service

timeout: 60s

rate_limits:

- actions:

- request_headers:

header_name: "foo"

descriptor_key: "foo"

http_filters:

- name: envoy.filters.http.ratelimit

typed_config:

"@type": type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit

domain: your_domain

failure_mode_deny: true

rate_limit_service:

grpc_service:

envoy_grpc:

cluster_name: rate_limit_service

transport_api_version: V3

- name: envoy.filters.http.router

typed_config:

"@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router

clusters:

- name: rate_limit_service

connect_timeout: 1.25s

type: LOGICAL_DNS

lb_policy: ROUND_ROBIN

http2_protocol_options: {}

load_assignment:

cluster_name: rate_limit_service

endpoints:

- lb_endpoints:

- endpoint:

address:

socket_address:

address: 127.0.0.1

port_value: 5001

[Dominik Winter]

I found the problem myself.
With the above configuration only requests would be rate limited when the request header "foo" is present.