Kuadrant / kuadrant-controller

Apache License 2.0
12 stars 7 forks source link

Enhanced RateLimitPolicy path matching #202

Closed eguzki closed 2 years ago

eguzki commented 2 years ago

Currently only exact path matching is implemented for the rules in the rate limit policy. For instance:

apiVersion: apim.kuadrant.io/v1alpha1
kind: RateLimitPolicy
metadata:
  name: global-settings
  namespace: istio-system
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: istio-ingressgateway
  rateLimits:
    - rules:
      - paths: ["/cats"]     <--- EXACT path matching !!!
      configurations:
        - actions:
            - remote_address: {}
      limits:
        - conditions: []
          maxValue: 2
          seconds: 10
          variables: ["remote_address"]   

Prefix based patch matching would be very convenient, as implemented in the Istio's Authorization policy

Exact Match and Prefix Match are core matchers of the Gateway API matchers, and RegularExpression matcher is left for custom support.

Implementing Prefix match would allow to specify prefixes in the RLP. For instance:

apiVersion: apim.kuadrant.io/v1alpha1
kind: RateLimitPolicy
metadata:
  name: global-settings
  namespace: istio-system
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: istio-ingressgateway
  rateLimits:
    - rules:
      - paths: ["/cats/*"]     <--- Prefix path matching !!!
      configurations:
        - actions:
            - remote_address: {}
      limits:
        - conditions: []
          maxValue: 2
          seconds: 10
          variables: ["remote_address"]