{"id":1731,"date":"2023-10-31T06:52:47","date_gmt":"2023-10-31T06:52:47","guid":{"rendered":"https:\/\/imesh.ai\/blog\/?p=1731"},"modified":"2024-01-18T14:07:58","modified_gmt":"2024-01-18T14:07:58","slug":"istio-rate-limiting-local","status":"publish","type":"post","link":"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/","title":{"rendered":"How to Configure Istio Local Rate Limiting"},"content":{"rendered":"\n<p>Istio does not expose a dedicated CRD, like <a href=\"https:\/\/imesh.ai\/blog\/what-are-istio-virtual-services-and-destination-rules\/\">virtual services and destination rules<\/a>, to configure a rate limiter. But DevOps can use Istio to change <a href=\"https:\/\/imesh.ai\/blog\/what-is-envoy-proxy\/\">Envoy proxy<\/a> configurations and then set up rate limiting.<\/p>\n\n\n\n<p>Here, I will show you how to enable Istio local rate limiting using Envoy filters. Before that, let us see what rate limiting is and the types of Istio rate limiting.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is rate limiting<\/h2>\n\n\n\n<p>Rate limiting is a mechanism to prevent services from being overwhelmed with requests. A rate limiter sets the maximum number of requests a service can receive in a given period and rejects requests exceeding the limit.<\/p>\n\n\n\n<p>For example, you can see below that the <em>payment <\/em>service\u2019s rate limiter is set to a maximum of 10 requests in 60 seconds\/per minute. Further requests receive <em>HTTP 400: Bad Request<\/em> status code.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img fetchpriority=\"high\" decoding=\"async\" width=\"960\" height=\"540\" src=\"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/rate-limiting-for-a-service-in-a-kubernetes-cluster.png\" alt=\"rate limiting for a service in a kubernetes cluster\" class=\"wp-image-1732\" srcset=\"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/rate-limiting-for-a-service-in-a-kubernetes-cluster.png 960w, https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/rate-limiting-for-a-service-in-a-kubernetes-cluster-300x169.png 300w, https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/rate-limiting-for-a-service-in-a-kubernetes-cluster-768x432.png 768w, https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/rate-limiting-for-a-service-in-a-kubernetes-cluster-400x225.png 400w, https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/rate-limiting-for-a-service-in-a-kubernetes-cluster-800x450.png 800w\" sizes=\"(max-width: 960px) 100vw, 960px\" \/><\/figure>\n<\/div>\n\n\n<p>DevOps teams implement rate limiting on critical services, such as login or payment. It helps to prevent malicious activities like DoS and brute force, which ensures service availability at all times.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Istio rate limiting<\/h2>\n\n\n\n<p>There are two types of Istio rate limiting: local and global.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Istio local rate limiting:<\/strong> Helps to configure rate limiter on a per pod\/Envoy proxy basis. Istio pilot generates <em>EnvoyFilter <\/em>resource, which DevOps can use to make changes directly to Envoy configurations to add a local rate limiter filter.<br>&nbsp;<\/li>\n\n\n\n<li><strong>Istio global rate limiting:<\/strong> Helps to configure rate limiter across pods in the mesh. It needs a central rate-limiting service connected to Envoy proxies across the mesh, which will then count the requests and take rate-limiting decisions. Check the blog, <a href=\"https:\/\/imesh.ai\/blog\/istio-rate-limiting-global\/\">How to Configure Istio Global Rate Limiting<\/a>, to learn more about it and to see how to set Istio rate limiting per IP.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Configuring Istio local rate limiting using Envoy filter<\/h2>\n\n\n\n<p>Let us briefly look into the token bucket algorithm and see how to set up Istio local rate limiting using Envoy filter.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Overview: Token bucket algorithm<\/h3>\n\n\n\n<p>Envoy proxy allows rate limiters to be set using the token bucket algorithm. It means that you can define the number of maximum tokens in the bucket i.e., the number of maximum requests the service can receive in a given time.<\/p>\n\n\n\n<p>Each request will consume a token. You can set the time for the bucket to be refilled and also the number of tokens to be refilled. If all tokens are consumed, further requests will be rejected until the tokens are refilled.<\/p>\n\n\n\n<p>For example, the token bucket in the below image means that only 5 requests can be sent to the service in the first 60 seconds. Then the client will have to wait for 60 seconds to complete to be able to send another 3 successful requests.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img decoding=\"async\" width=\"960\" height=\"540\" src=\"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/token-bucket-rate-limiting-algorithm.png\" alt=\"token bucket rate limiting algorithm\" class=\"wp-image-1733\" srcset=\"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/token-bucket-rate-limiting-algorithm.png 960w, https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/token-bucket-rate-limiting-algorithm-300x169.png 300w, https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/token-bucket-rate-limiting-algorithm-768x432.png 768w, https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/token-bucket-rate-limiting-algorithm-400x225.png 400w, https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/token-bucket-rate-limiting-algorithm-800x450.png 800w\" sizes=\"(max-width: 960px) 100vw, 960px\" \/><\/figure>\n<\/div>\n\n\n<h3 class=\"wp-block-heading\">Prerequisites<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>I am using Istio 1.16.7 on AKS.<br><\/li>\n\n\n\n<li>I have two stateful<em> <\/em>services \u2014 <a href=\"https:\/\/github.com\/imesh-ai\/webinar\/blob\/add-envoyfilters-rate-limiting\/Rate%20Limiting%20With%20EnvoyFilter\/httpbin.yaml\"><em>httpbin<\/em><\/a><em> <\/em>and <a href=\"https:\/\/github.com\/imesh-ai\/webinar\/blob\/add-envoyfilters-rate-limiting\/Rate%20Limiting%20With%20EnvoyFilter\/sleep.yaml\"><em>sleep<\/em><\/a> \u2014 deployed in an Istio-enabled namespace, <em>rl<\/em>.<br><\/li>\n\n\n\n<li>Both services have one pod each, with Evoy proxy sidecars injected into them.<br><\/li>\n\n\n\n<li>All resources used for the demo are in the <a href=\"https:\/\/github.com\/imesh-ai\/webinar\/tree\/add-envoyfilters-rate-limiting\/Rate%20Limiting%20With%20EnvoyFilter\">IMESH git repo folder<\/a>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Steps to enable Istio local rate limiting<\/h3>\n\n\n\n<p>Follow the steps to set up a local rate limiter on <em>httpbin <\/em>pod:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"#envoyfilter\">Step #1: Apply <em>EnvoyFilter <\/em>CRD<\/a><\/li>\n\n\n\n<li><a href=\"#ratelimiter\">Step #2: Verify rate limiter<\/a><\/li>\n\n\n\n<li><a href=\"#header-based\">Step #3: Header-based rate limiting with descriptors and actions<\/a><\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading envoyfilter\" id=\"envoyfilter\">Step #1: Apply <em>EnvoyFilter<\/em> CRD<\/h4>\n\n\n\n<p>Rate limiting can be applied on both source or destination pods. I\u2019m applying the following <em>EnvoyFilter <\/em>CRD on the destination pod, which is <em>httpbin<\/em>.<\/p>\n\n\n\n<p>You can see the whole <em>EnvoyFilter <\/em>CRD here: <a href=\"https:\/\/github.com\/imesh-ai\/webinar\/blob\/add-envoyfilters-rate-limiting\/Rate%20Limiting%20With%20EnvoyFilter\/local\/httpbin-ratelimit-simple.yaml\"><em>httpbin-ratelimit-simple.yaml<\/em><\/a>.<\/p>\n\n\n\n<p>Let me break down what each part of the <em>EnvoyFilter <\/em>resource means because it is vital to know what you are doing while making changes there.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><em>workloadSelector<\/em>:<\/strong> Here we mention the pod where we need to set up the rate limiter. Otherwise, the filter will apply to all pods in the namespace.<br><br>I selected the destination pod, <em>httpbin <\/em>in <em>rl <\/em>namespace, to which the <em>EnvoyFilter <\/em>will be applied.<br><\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code has-white-color has-black-background-color has-text-color has-background\"><code>kind: EnvoyFilter\nmetadata:\n  name: httpbin-ratelimit\n  namespace: rl\nspec:\n  workloadSelector:\n    labels:\n      app: httpbin<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><em>configPatches<\/em>:<\/strong> It describes the patch configurations, i.e., the rate limiter configuration, we apply.<br><br>Here we apply the patch to the <em>HTTP_FILTER<\/em> value and specify it should be applied on inbound requests to the <em>httpbin <\/em>sidecar, by setting <em>context: SIDECAR_INBOUND<\/em>.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code has-white-color has-black-background-color has-text-color has-background\"><code>configPatches:\n&nbsp; &nbsp; - applyTo: HTTP_FILTER\n&nbsp; &nbsp; &nbsp; match:\n&nbsp; &nbsp; &nbsp; &nbsp; context: SIDECAR_INBOUND<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><em>listener<\/em>:<\/strong> Listeners are bound to a specific port and IP address and they receive requests. Envoy proxy can have multiple listeners and each listener has filter chains attached to it.<br><br>Filter chains can manipulate requests as they go through them. We select the <em>http_connection_manager <\/em>(HCM) filter out of the filter chain to add the patch, i.e., rate limiter rules.<br><\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code has-white-color has-black-background-color has-text-color has-background\"><code> listener:\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; filterChain:\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; filter:\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; name: \"envoy.filters.network.http_connection_manager\"<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><em>patch<\/em><\/strong><strong>:<\/strong> This is where we define the token bucket rate limiting algorithm.<br><br>We set <a href=\"https:\/\/istio.io\/latest\/docs\/reference\/config\/networking\/envoy-filter\/#EnvoyFilter-Patch-Operation\"><em>operation: INSERT_BEFORE<\/em><\/a>, which specifies that the following rate limiter configuration gets applied first, at the top of the HTTP filter list, since the order of elements matters for filters.<br><\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code has-white-color has-black-background-color has-text-color has-background\"><code>patch:\n&nbsp; &nbsp; &nbsp; &nbsp; operation: INSERT_BEFORE\n&nbsp; &nbsp; &nbsp; &nbsp; value:\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; name: envoy.filters.http.local_ratelimit<\/code><\/pre>\n\n\n\n<p><br>We use the extension, <a href=\"https:\/\/www.envoyproxy.io\/docs\/envoy\/latest\/api-v3\/extensions\/filters\/http\/local_ratelimit\/v3\/local_rate_limit.proto\"><em>envoy.filters.http.local_ratelimit<\/em><\/a>, to extend <a href=\"https:\/\/www.envoyproxy.io\/docs\/envoy\/latest\/api-v3\/extensions\/filters\/network\/http_connection_manager\/v3\/http_connection_manager.proto#extension-category-envoy-filters-http\"><em>envoy.filters.http<\/em><\/a> and set rate limiter configurations using the fields provided by the extension.<br><br>Note: Look at <a href=\"https:\/\/istio.io\/latest\/docs\/releases\/supported-releases\/#supported-envoy-versions\">Istio&#8217;s envoy version relationship table<\/a> and be careful about the version of Envoy docs you are referring to.<br><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><em>typed_config<\/em><\/strong><strong>:<\/strong> It specifies the configuration for the rate limiter filter, and <em>type_url <\/em>defines the structure of the configuration.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code has-white-color has-black-background-color has-text-color has-background\"><code>typed_config:\n            \"@type\": type.googleapis.com\/udpa.type.v1.TypedStruct\n            type_url: type.googleapis.com\/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><em>stat_prefix<\/em><\/strong><strong>:<\/strong> The field is for the likes of Prometheus and Grafana to scrape metrics.<br><\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code has-white-color has-black-background-color has-text-color has-background\"><code> value:\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; stat_prefix: http_local_rate_limiter<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><em>token_bucket<\/em><\/strong><strong>:<\/strong> Here we define the maximum number of tokens allowed, the time to refill the tokens, and the number of tokens to be refilled.<br><br>The configuration specifies a maximum of 10 requests to go through and wait for a minute, before the clients can make 5 more requests. When there are no tokens left, the request will be rate-limited and receive the response status code (which is <em>BadRequest <\/em>(HTTP 400) here).<br><\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code has-white-color has-black-background-color has-text-color has-background\"><code>token_bucket:\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; max_tokens: 10\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; tokens_per_fill: 5\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; fill_interval: 60s<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><em>filter_enabled<\/em><\/strong><strong>, <\/strong><strong><em>filter_enforced<\/em><\/strong><strong>:<\/strong> They specify the percentage of requests on which rate limiter should be enabled and enforced, respectively.<br><br>The numerator and denominator values define the percentage, and the request is rate-limited only if it falls into the enforced percentage of requests.<br><\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code has-white-color has-black-background-color has-text-color has-background\"><code>filter_enabled:\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; runtime_key: local_rate_limit_enabled\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; default_value:\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; numerator: 100\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; denominator: HUNDRED\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; filter_enforced:\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; runtime_key: local_rate_limit_enforced\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; default_value:\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; numerator: 100\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; denominator: HUNDRED<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><em>response_headers_to_add<\/em><\/strong><strong>:<\/strong> Here we can define the response headers when a request is rate-limited. Along with the status code, an additional header of <em>x-rate-limited: TOO_MANY_REQUESTS<\/em> is added.<br><\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code has-white-color has-black-background-color has-text-color has-background\"><code>response_headers_to_add:\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; - append_action: APPEND_IF_EXISTS_OR_ADD\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header:\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; key: x-rate-limited\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; value: TOO_MANY_REQUESTS\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; status:\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; code: BadRequest<\/code><\/pre>\n\n\n\n<p>Now let us apply the <a href=\"https:\/\/github.com\/imesh-ai\/webinar\/blob\/add-envoyfilters-rate-limiting\/Rate%20Limiting%20With%20EnvoyFilter\/local\/httpbin-ratelimit-simple.yaml\">rate limiter yaml<\/a> in the Istio-enabled, <em>rl <\/em>namespace:<\/p>\n\n\n\n<pre class=\"wp-block-code has-white-color has-black-background-color has-text-color has-background\"><code>kubectl apply -f basic\/httpbin-ratelimit-simple.yaml -n rl<\/code><\/pre>\n\n\n\n<p>Keep in mind that this rate limiter will be applied to all <em>httpbin <\/em>pods. Each pod will have the token bucket defined in the configuration.<\/p>\n\n\n\n<h4 class=\"wp-block-heading ratelimiter\" id=\"ratelimiter\">Step #2: Verify rate limiter<\/h4>\n\n\n\n<p>To verify if the rate limiter is working, I will <em>exec <\/em>into the <em>sleep <\/em>pod and then <em>curl httpbin <\/em>pod:<\/p>\n\n\n\n<pre class=\"wp-block-code has-white-color has-black-background-color has-text-color has-background\"><code>kubectl exec -it sleep-0 -n rl -- sh\ncurl v \"http:\/\/httpbin:8080\/get\"&nbsp;<\/code><\/pre>\n\n\n\n<p>After a few successful requests (<em>200 OK<\/em>), the rate limiter kicked in and I got <em>400 Bad Request<\/em> response as shown below:<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img decoding=\"async\" width=\"746\" height=\"414\" src=\"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/istio-rate-limiter-respond-bad-request.png\" alt=\"istio rate limiter respond bad request\" class=\"wp-image-1734\" srcset=\"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/istio-rate-limiter-respond-bad-request.png 746w, https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/istio-rate-limiter-respond-bad-request-300x166.png 300w, https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/istio-rate-limiter-respond-bad-request-400x222.png 400w\" sizes=\"(max-width: 746px) 100vw, 746px\" \/><\/figure>\n<\/div>\n\n\n<p><br>Once the above response is received, we will have to wait for a minute for the token bucket to be refilled. Then we can make 5 more successful requests in the next minute, as defined in the local rate limiter config.<\/p>\n\n\n<!-- Ad space powered by WP AdCenter v2.5.7 - https:\/\/wpadcenter.com\/ --><div class=\"wpadcenter-ad-container\" ><div id=\"wpadcenter-ad-1869\" class=\"ad-970x250 wpadcenter-970x250 ad-placement  wpadcenter-alignnone alignnone\"><div class=\"wpadcenter-ad-inner\" ><a id=\"wpadcenter_ad\" data-value=1869 data-placement=\"\" href=\"https:\/\/imesh.ai\/istio-service-mesh-case-studies.html?utm_source=Click&utm_medium=banner-ebook&utm_campaign=Istio+Rate+limiting+Local&utm_id=read-case-study\" target=\"_self\" class=\"wpadcenter-ad-inner__item\" ><img loading=\"lazy\" decoding=\"async\" width=\"970\" height=\"250\" src=\"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2024\/01\/Mindtickle-case-study-1.png\" class=\"attachment-post-thumbnail size-post-thumbnail wp-post-image\" alt=\"Mindtickle case study\" srcset=\"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2024\/01\/Mindtickle-case-study-1.png 970w, https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2024\/01\/Mindtickle-case-study-1-300x77.png 300w, https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2024\/01\/Mindtickle-case-study-1-768x198.png 768w, https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2024\/01\/Mindtickle-case-study-1-400x103.png 400w, https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2024\/01\/Mindtickle-case-study-1-800x206.png 800w\" sizes=\"(max-width: 970px) 100vw, 970px\" \/><\/a><\/div><\/div><\/div>\n\n\n\n<h4 class=\"wp-block-heading header-based\">Step #3: Header-based rate limiting with descriptors and actions<\/h4>\n\n\n\n<p>The above rate limiter configuration counts every request to the <em>httpbin <\/em>pod and applies the rate limiter whenever it crosses 10 requests, initially.<\/p>\n\n\n\n<p>What if you want the rate limiter to count only requests with a certain header value? That is where we use <a href=\"https:\/\/www.envoyproxy.io\/docs\/envoy\/latest\/configuration\/http\/http_filters\/local_rate_limit_filter#using-rate-limit-descriptors-for-local-rate-limiting\">descriptors and actions<\/a> .<\/p>\n\n\n\n<p>Check <a href=\"https:\/\/github.com\/imesh-ai\/webinar\/blob\/add-envoyfilters-rate-limiting\/Rate%20Limiting%20With%20EnvoyFilter\/local\/httpbin-ratelimit.yaml\"><em>httpbin-ratelimit.yaml<\/em><\/a>. I have added the following section towards the end of the configuration used in step #1:<\/p>\n\n\n\n<pre class=\"wp-block-code has-white-color has-black-background-color has-text-color has-background\"><code>descriptors:\n&nbsp; &nbsp; &nbsp; - entries:\n&nbsp; &nbsp; &nbsp; &nbsp; - key: \"header-rate-limit\"\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; value: \"true\"\n&nbsp; &nbsp; &nbsp; &nbsp; token_bucket:\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; max_tokens: 2\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; tokens_per_fill: 1\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; fill_interval: 60s\n- applyTo: VIRTUAL_HOST\n&nbsp; match:\n&nbsp; &nbsp; &nbsp; context: SIDECAR_INBOUND\n&nbsp; &nbsp; &nbsp; routeConfiguration:\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; vhost:\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; name: \"inbound|http|8000\"\n&nbsp; patch:\n&nbsp; &nbsp; &nbsp; operation: MERGE\n&nbsp; &nbsp; &nbsp; value:\n&nbsp; &nbsp; &nbsp; &nbsp; rate_limits:\n&nbsp; &nbsp; &nbsp; &nbsp; - actions:\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; - request_headers:\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header_name: \"x-rate-limit\"\n&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; descriptor_key: \"header-rate-limit\"&nbsp;<\/code><\/pre>\n\n\n\n<p>Under the virtual host configuration for inbound requests on port 8000, we define that if the request header is <em>x-rate-limit<\/em>, it gets assigned to the <em>header-rate-limit <\/em>variable, which is called a descriptor. The descriptor will be attached to the request.<\/p>\n\n\n\n<p>Under <em>descriptors <\/em>in the beginning, we define that if the request contains the <em>header-rate-limit <\/em>descriptor, apply the following configured token bucket (<em>max_token: 2<\/em>, <em>token_per_refill: 1<\/em>, <em>fill_interval: 60s<\/em>).<\/p>\n\n\n\n<p>If the request does not have the said descriptor entry, the token bucket defined in step #1 will be applied.<\/p>\n\n\n\n<p>You can verify header-based rate limiting by passing the header value into the <em>curl <\/em>request:<\/p>\n\n\n\n<pre class=\"wp-block-code has-white-color has-black-background-color has-text-color has-background\"><code>kubectl exec -it sleep-0 -n rl -- sh\ncurl -v \"http:\/\/httpbin:8080\/get\" -H \"x-rate-limit: true\"<\/code><\/pre>\n\n\n\n<p>Only 2 requests will be allowed in this case (<em>max_token: 2<\/em>), and you will have to wait for a minute (<em>fill_interval: 60s<\/em>) to send another successful request (<em>token_per_refill: 1<\/em>).<\/p>\n\n\n\n<p>DevOps teams can define rate-limiting actions on the following descriptors, other than header value (<a href=\"https:\/\/www.envoyproxy.io\/docs\/envoy\/latest\/api-v3\/config\/route\/v3\/route_components.proto#envoy-v3-api-msg-config-route-v3-ratelimit\">check here<\/a> for more info):<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"394\" height=\"249\" src=\"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/istio-local-rate-limiting-action-descriptors.png\" alt=\"\" class=\"wp-image-1735\" style=\"aspect-ratio:1.5823293172690762;width:674px;height:auto\" srcset=\"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/istio-local-rate-limiting-action-descriptors.png 394w, https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/istio-local-rate-limiting-action-descriptors-300x190.png 300w\" sizes=\"(max-width: 394px) 100vw, 394px\" \/><\/figure>\n<\/div>\n\n\n<h2 class=\"wp-block-heading\">Rate limiting at Istio ingress gateway<\/h2>\n\n\n\n<p>There is not much difference in the configuration we used above to set rate limiting at <a href=\"https:\/\/imesh.ai\/blog\/how-to-use-istio-ingress-gateway-as-application-load-balancer-alb\/\">Istio Ingress Gateway<\/a>.<\/p>\n\n\n\n<p>The only changes are in the <em>workloadSelector <\/em>field and the <em>context <\/em>where the rate limiter patch gets applied to:<\/p>\n\n\n\n<pre class=\"wp-block-code has-white-color has-black-background-color has-text-color has-background\"><code>apiVersion: networking.istio.io\/v1alpha3\nkind: EnvoyFilter\nmetadata:\n&nbsp;&nbsp;name: ratelimit-ingressgateway\n&nbsp;&nbsp;namespace: istio-system\nspec:\n&nbsp;&nbsp;workloadSelector:\n&nbsp;&nbsp;&nbsp;&nbsp;labels:\n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;istio: ingressgateway\n&nbsp;&nbsp;configPatches:\n&nbsp; &nbsp; - applyTo: HTTP_FILTER\n&nbsp; &nbsp; &nbsp; match:\n&nbsp; &nbsp; &nbsp; &nbsp; context: GATEWAY<\/code><\/pre>\n\n\n\n<p>In the above configuration, we change the <em>workloadSelector<\/em> to match the ingress gateway as the Istio Ingress Gateway is itself an Envoy proxy.<\/p>\n\n\n\n<p>And since there is a difference in the configuration for sidecars and gateways, we also need to change the <em>context<\/em> to <em>GATEWAY<\/em> from <em>SIDECAR_INBOUND<\/em>.<\/p>\n\n\n\n<p>The rest of the configuration remains and works the same as before.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Word of advice: be careful with Envoy filters<\/h2>\n\n\n\n<p>Be mindful about what you are doing with <em>EnvoyFilter<\/em> CRD. A slight mess-up in the configuration can destabilize the entire mesh.<\/p>\n\n\n\n<p>For example, if you are not careful about where you are applying the rate limiter you may rate limit the connection to the control plane, i.e., Istiod.<\/p>\n\n\n\n<p>It is also hard to troubleshoot such issues because there is no way to see for which connection the rate limiter got applied, apart from looking at the configuration again.<\/p>\n\n\n\n<p>Other than that, the order of the <em>EnvoyFilter<\/em> resource matters (parsing happens from top-to-bottom). If you are new, it would take some playing around to get it \u2014 and even more to deploy the configuration in a production environment. And, although unlikely, changes will have to be made when there are modifications in <em>EnvoyFilter <\/em>CRD or the local rate limiter proto.<\/p>\n\n\n\n<p>To get around these challenges, we provide <a href=\"https:\/\/imesh.ai\/managed-istio.html\">managed Istio<\/a> at IMESH. Our Istio experts help enterprises set up advanced Istio and Envoy features \u2014 such as rate limiters at service or ingress\/egress gateway level \u2014 in production from day one. It helps DevOps teams and architects maintain a resilient and available infrastructure.<\/p>\n\n\n\n<p>Feel free to check out the offer here: <a href=\"https:\/\/imesh.ai\/managed-istio.html\">https:\/\/imesh.ai\/managed-istio.html<\/a>.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Istio does not expose a dedicated CRD, like virtual services and destination<span class=\"excerpt-more\"><\/span><\/p>\n","protected":false},"author":10,"featured_media":1736,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[32,38,118],"tags":[53,84,119],"class_list":["post-1731","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-istio-service-mesh","category-network","category-rate-limiting","tag-istio","tag-network","tag-rate-limiting"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How to Configure Istio Local Rate Limiting<\/title>\n<meta name=\"description\" content=\"Explore Istio rate limiting, its types, and learn how to set up Istio local rate limiter per Envoy proxy and ingress gateway level.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Configure Istio Local Rate Limiting\" \/>\n<meta property=\"og:description\" content=\"Explore Istio rate limiting, its types, and learn how to set up Istio local rate limiter per Envoy proxy and ingress gateway level.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/\" \/>\n<meta property=\"og:site_name\" content=\"IMESH\" \/>\n<meta property=\"article:published_time\" content=\"2023-10-31T06:52:47+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-01-18T14:07:58+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/How-to-Configure-Istio-Local-Rate-Limiting.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Pulak Das\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Pulak Das\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/\"},\"author\":{\"name\":\"Pulak Das\",\"@id\":\"https:\/\/imesh.ai\/blog\/#\/schema\/person\/13792df637b7c676b353e85f12d3f6c1\"},\"headline\":\"How to Configure Istio Local Rate Limiting\",\"datePublished\":\"2023-10-31T06:52:47+00:00\",\"dateModified\":\"2024-01-18T14:07:58+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/\"},\"wordCount\":1680,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/imesh.ai\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/How-to-Configure-Istio-Local-Rate-Limiting.png\",\"keywords\":[\"istio\",\"network\",\"rate limiting\"],\"articleSection\":[\"Istio service mesh\",\"Network\",\"Rate Limiting\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/\",\"url\":\"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/\",\"name\":\"How to Configure Istio Local Rate Limiting\",\"isPartOf\":{\"@id\":\"https:\/\/imesh.ai\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/How-to-Configure-Istio-Local-Rate-Limiting.png\",\"datePublished\":\"2023-10-31T06:52:47+00:00\",\"dateModified\":\"2024-01-18T14:07:58+00:00\",\"description\":\"Explore Istio rate limiting, its types, and learn how to set up Istio local rate limiter per Envoy proxy and ingress gateway level.\",\"breadcrumb\":{\"@id\":\"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/#primaryimage\",\"url\":\"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/How-to-Configure-Istio-Local-Rate-Limiting.png\",\"contentUrl\":\"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/How-to-Configure-Istio-Local-Rate-Limiting.png\",\"width\":1280,\"height\":720,\"caption\":\"How to Configure Istio Local Rate Limiting\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/imesh.ai\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Configure Istio Local Rate Limiting\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/imesh.ai\/blog\/#website\",\"url\":\"https:\/\/imesh.ai\/blog\/\",\"name\":\"IMESH Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/imesh.ai\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/imesh.ai\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/imesh.ai\/blog\/#organization\",\"name\":\"IMESH\",\"url\":\"https:\/\/imesh.ai\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/imesh.ai\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/03\/IMESH-LOGO-scaled.jpg\",\"contentUrl\":\"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/03\/IMESH-LOGO-scaled.jpg\",\"width\":2560,\"height\":1665,\"caption\":\"IMESH\"},\"image\":{\"@id\":\"https:\/\/imesh.ai\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/imeshai\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/imesh.ai\/blog\/#\/schema\/person\/13792df637b7c676b353e85f12d3f6c1\",\"name\":\"Pulak Das\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/imesh.ai\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/03\/IMG_20230222_170121-150x150.jpg\",\"contentUrl\":\"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/03\/IMG_20230222_170121-150x150.jpg\",\"caption\":\"Pulak Das\"},\"description\":\"Pulak is the Istio and Envoy expert in IMESH. He is a front-end developer passionate about open-source software, design, and typography. His scientific interests as a computer science graduate are at the systems level: operating systems and programming languages.\",\"sameAs\":[\"https:\/\/imesh.ai\"],\"url\":\"https:\/\/imesh.ai\/blog\/author\/pulak-dasimesh-ai\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Configure Istio Local Rate Limiting","description":"Explore Istio rate limiting, its types, and learn how to set up Istio local rate limiter per Envoy proxy and ingress gateway level.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/","og_locale":"en_US","og_type":"article","og_title":"How to Configure Istio Local Rate Limiting","og_description":"Explore Istio rate limiting, its types, and learn how to set up Istio local rate limiter per Envoy proxy and ingress gateway level.","og_url":"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/","og_site_name":"IMESH","article_published_time":"2023-10-31T06:52:47+00:00","article_modified_time":"2024-01-18T14:07:58+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/How-to-Configure-Istio-Local-Rate-Limiting.png","type":"image\/png"}],"author":"Pulak Das","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Pulak Das","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/#article","isPartOf":{"@id":"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/"},"author":{"name":"Pulak Das","@id":"https:\/\/imesh.ai\/blog\/#\/schema\/person\/13792df637b7c676b353e85f12d3f6c1"},"headline":"How to Configure Istio Local Rate Limiting","datePublished":"2023-10-31T06:52:47+00:00","dateModified":"2024-01-18T14:07:58+00:00","mainEntityOfPage":{"@id":"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/"},"wordCount":1680,"commentCount":0,"publisher":{"@id":"https:\/\/imesh.ai\/blog\/#organization"},"image":{"@id":"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/#primaryimage"},"thumbnailUrl":"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/How-to-Configure-Istio-Local-Rate-Limiting.png","keywords":["istio","network","rate limiting"],"articleSection":["Istio service mesh","Network","Rate Limiting"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/","url":"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/","name":"How to Configure Istio Local Rate Limiting","isPartOf":{"@id":"https:\/\/imesh.ai\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/#primaryimage"},"image":{"@id":"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/#primaryimage"},"thumbnailUrl":"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/How-to-Configure-Istio-Local-Rate-Limiting.png","datePublished":"2023-10-31T06:52:47+00:00","dateModified":"2024-01-18T14:07:58+00:00","description":"Explore Istio rate limiting, its types, and learn how to set up Istio local rate limiter per Envoy proxy and ingress gateway level.","breadcrumb":{"@id":"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/#primaryimage","url":"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/How-to-Configure-Istio-Local-Rate-Limiting.png","contentUrl":"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/How-to-Configure-Istio-Local-Rate-Limiting.png","width":1280,"height":720,"caption":"How to Configure Istio Local Rate Limiting"},{"@type":"BreadcrumbList","@id":"https:\/\/imesh.ai\/blog\/istio-rate-limiting-local\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/imesh.ai\/blog\/"},{"@type":"ListItem","position":2,"name":"How to Configure Istio Local Rate Limiting"}]},{"@type":"WebSite","@id":"https:\/\/imesh.ai\/blog\/#website","url":"https:\/\/imesh.ai\/blog\/","name":"IMESH Blog","description":"","publisher":{"@id":"https:\/\/imesh.ai\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/imesh.ai\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/imesh.ai\/blog\/#organization","name":"IMESH","url":"https:\/\/imesh.ai\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/imesh.ai\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/03\/IMESH-LOGO-scaled.jpg","contentUrl":"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/03\/IMESH-LOGO-scaled.jpg","width":2560,"height":1665,"caption":"IMESH"},"image":{"@id":"https:\/\/imesh.ai\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.linkedin.com\/company\/imeshai"]},{"@type":"Person","@id":"https:\/\/imesh.ai\/blog\/#\/schema\/person\/13792df637b7c676b353e85f12d3f6c1","name":"Pulak Das","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/imesh.ai\/blog\/#\/schema\/person\/image\/","url":"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/03\/IMG_20230222_170121-150x150.jpg","contentUrl":"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/03\/IMG_20230222_170121-150x150.jpg","caption":"Pulak Das"},"description":"Pulak is the Istio and Envoy expert in IMESH. He is a front-end developer passionate about open-source software, design, and typography. His scientific interests as a computer science graduate are at the systems level: operating systems and programming languages.","sameAs":["https:\/\/imesh.ai"],"url":"https:\/\/imesh.ai\/blog\/author\/pulak-dasimesh-ai\/"}]}},"jetpack_featured_media_url":"https:\/\/imesh.ai\/blog\/wp-content\/uploads\/2023\/10\/How-to-Configure-Istio-Local-Rate-Limiting.png","_links":{"self":[{"href":"https:\/\/imesh.ai\/blog\/wp-json\/wp\/v2\/posts\/1731","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/imesh.ai\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/imesh.ai\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/imesh.ai\/blog\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/imesh.ai\/blog\/wp-json\/wp\/v2\/comments?post=1731"}],"version-history":[{"count":8,"href":"https:\/\/imesh.ai\/blog\/wp-json\/wp\/v2\/posts\/1731\/revisions"}],"predecessor-version":[{"id":1870,"href":"https:\/\/imesh.ai\/blog\/wp-json\/wp\/v2\/posts\/1731\/revisions\/1870"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/imesh.ai\/blog\/wp-json\/wp\/v2\/media\/1736"}],"wp:attachment":[{"href":"https:\/\/imesh.ai\/blog\/wp-json\/wp\/v2\/media?parent=1731"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/imesh.ai\/blog\/wp-json\/wp\/v2\/categories?post=1731"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/imesh.ai\/blog\/wp-json\/wp\/v2\/tags?post=1731"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}