rate limit: add local rate limit network filter (#9354)

Signed-off-by: Matt Klein <mklein@lyft.com>

Mirrored from https://github.com/envoyproxy/envoy @ 9b3915d57ffc280eccab30c34f58926ade5a984e

BUILD

@@ -84,6 +84,8 @@ proto_library(
         "//envoy/config/filter/network/ext_authz/v3alpha:pkg",
         "//envoy/config/filter/network/http_connection_manager/v2:pkg",
         "//envoy/config/filter/network/http_connection_manager/v3alpha:pkg",
+        "//envoy/config/filter/network/local_rate_limit/v2alpha:pkg",
+        "//envoy/config/filter/network/local_rate_limit/v3alpha:pkg",
         "//envoy/config/filter/network/mongo_proxy/v2:pkg",
         "//envoy/config/filter/network/mongo_proxy/v3alpha:pkg",
         "//envoy/config/filter/network/mysql_proxy/v1alpha1:pkg",

docs/BUILD

@@ -59,6 +59,7 @@ proto_library(
         "//envoy/config/filter/network/dubbo_proxy/v2alpha1:pkg",
         "//envoy/config/filter/network/ext_authz/v2:pkg",
         "//envoy/config/filter/network/http_connection_manager/v2:pkg",
+        "//envoy/config/filter/network/local_rate_limit/v2alpha:pkg",
         "//envoy/config/filter/network/mongo_proxy/v2:pkg",
         "//envoy/config/filter/network/mysql_proxy/v1alpha1:pkg",
         "//envoy/config/filter/network/rate_limit/v2:pkg",

envoy/api/v2/route/route.proto

@@ -1178,7 +1178,7 @@ message VirtualCluster {
   core.RequestMethod method = 3 [deprecated = true];
 }
 
-// Global rate limiting :ref:`architecture overview <arch_overview_rate_limit>`.
+// Global rate limiting :ref:`architecture overview <arch_overview_global_rate_limit>`.
 message RateLimit {
   // [#next-free-field: 7]
   message Action {

envoy/api/v3alpha/route/route.proto

@@ -1167,7 +1167,7 @@ message VirtualCluster {
   string name = 2 [(validate.rules).string = {min_bytes: 1}];
 }
 
-// Global rate limiting :ref:`architecture overview <arch_overview_rate_limit>`.
+// Global rate limiting :ref:`architecture overview <arch_overview_global_rate_limit>`.
 message RateLimit {
   option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.route.RateLimit";
 

envoy/config/filter/network/local_rate_limit/v2alpha/BUILD

@@ -0,0 +1,12 @@
+# DO NOT EDIT. This file is generated by tools/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = [
+        "//envoy/api/v2/core:pkg",
+        "//envoy/type:pkg",
+    ],
+)

envoy/config/filter/network/local_rate_limit/v2alpha/local_rate_limit.proto

@@ -0,0 +1,40 @@
+syntax = "proto3";
+
+package envoy.config.filter.network.local_rate_limit.v2alpha;
+
+import "envoy/api/v2/core/base.proto";
+import "envoy/type/token_bucket.proto";
+
+import "validate/validate.proto";
+
+option java_package = "io.envoyproxy.envoy.config.filter.network.local_rate_limit.v2alpha";
+option java_outer_classname = "LocalRateLimitProto";
+option java_multiple_files = true;
+
+// [#protodoc-title: Local rate limit]
+// Local rate limit :ref:`configuration overview <config_network_filters_local_rate_limit>`.
+// [#extension: envoy.filters.network.local_ratelimit]
+
+message LocalRateLimit {
+  // The prefix to use when emitting :ref:`statistics
+  // <config_network_filters_local_rate_limit_stats>`.
+  string stat_prefix = 1 [(validate.rules).string = {min_bytes: 1}];
+
+  // The token bucket configuration to use for rate limiting connections that are processed by the
+  // filter's filter chain. Each incoming connection processed by the filter consumes a single
+  // token. If the token is available, the connection will be allowed. If no tokens are available,
+  // the connection will be immediately closed.
+  //
+  // .. note::
+  //   In the current implementation each filter and filter chain has an independent rate limit.
+  //
+  // .. note::
+  //   In the current implementation the token bucket's :ref:`fill_interval
+  //   <envoy_api_field_type.TokenBucket.fill_interval>` must be >= 50ms to avoid too aggressive
+  //   refills.
+  type.TokenBucket token_bucket = 2 [(validate.rules).message = {required: true}];
+
+  // Runtime flag that controls whether the filter is enabled or not. If not specified, defaults
+  // to enabled.
+  api.v2.core.RuntimeFeatureFlag runtime_enabled = 3;
+}

envoy/config/filter/network/local_rate_limit/v3alpha/BUILD

@@ -0,0 +1,14 @@
+# DO NOT EDIT. This file is generated by tools/proto_sync.py.
+
+load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package")
+
+licenses(["notice"])  # Apache 2
+
+api_proto_package(
+    deps = [
+        "//envoy/api/v3alpha/core:pkg",
+        "//envoy/config/filter/network/local_rate_limit/v2alpha:pkg",
+        "//envoy/type/v3alpha:pkg",
+        "@com_github_cncf_udpa//udpa/annotations:pkg",
+    ],
+)

envoy/config/filter/network/local_rate_limit/v3alpha/local_rate_limit.proto

@@ -0,0 +1,45 @@
+syntax = "proto3";
+
+package envoy.config.filter.network.local_rate_limit.v3alpha;
+
+import "envoy/api/v3alpha/core/base.proto";
+import "envoy/type/v3alpha/token_bucket.proto";
+
+import "udpa/annotations/versioning.proto";
+
+import "validate/validate.proto";
+
+option java_package = "io.envoyproxy.envoy.config.filter.network.local_rate_limit.v3alpha";
+option java_outer_classname = "LocalRateLimitProto";
+option java_multiple_files = true;
+
+// [#protodoc-title: Local rate limit]
+// Local rate limit :ref:`configuration overview <config_network_filters_local_rate_limit>`.
+// [#extension: envoy.filters.network.local_ratelimit]
+
+message LocalRateLimit {
+  option (udpa.annotations.versioning).previous_message_type =
+      "envoy.config.filter.network.local_rate_limit.v2alpha.LocalRateLimit";
+
+  // The prefix to use when emitting :ref:`statistics
+  // <config_network_filters_local_rate_limit_stats>`.
+  string stat_prefix = 1 [(validate.rules).string = {min_bytes: 1}];
+
+  // The token bucket configuration to use for rate limiting connections that are processed by the
+  // filter's filter chain. Each incoming connection processed by the filter consumes a single
+  // token. If the token is available, the connection will be allowed. If no tokens are available,
+  // the connection will be immediately closed.
+  //
+  // .. note::
+  //   In the current implementation each filter and filter chain has an independent rate limit.
+  //
+  // .. note::
+  //   In the current implementation the token bucket's :ref:`fill_interval
+  //   <envoy_api_field_type.v3alpha.TokenBucket.fill_interval>` must be >= 50ms to avoid too
+  //   aggressive refills.
+  type.v3alpha.TokenBucket token_bucket = 2 [(validate.rules).message = {required: true}];
+
+  // Runtime flag that controls whether the filter is enabled or not. If not specified, defaults
+  // to enabled.
+  api.v3alpha.core.RuntimeFeatureFlag runtime_enabled = 3;
+}

envoy/type/token_bucket.proto

@@ -0,0 +1,33 @@
+syntax = "proto3";
+
+package envoy.type;
+
+import "google/protobuf/duration.proto";
+import "google/protobuf/wrappers.proto";
+
+import "validate/validate.proto";
+
+option java_package = "io.envoyproxy.envoy.type";
+option java_outer_classname = "TokenBucketProto";
+option java_multiple_files = true;
+
+// [#protodoc-title: Token bucket]
+
+// Configures a token bucket, typically used for rate limiting.
+message TokenBucket {
+  // The maximum tokens that the bucket can hold. This is also the number of tokens that the bucket
+  // initially contains.
+  uint32 max_tokens = 1 [(validate.rules).uint32 = {gt: 0}];
+
+  // The number of tokens added to the bucket during each fill interval. If not specified, defaults
+  // to a single token.
+  google.protobuf.UInt32Value tokens_per_fill = 2 [(validate.rules).uint32 = {gt: 0}];
+
+  // The fill interval that tokens are added to the bucket. During each fill interval
+  // `tokens_per_fill` are added to the bucket. The bucket will never contain more than
+  // `max_tokens` tokens.
+  google.protobuf.Duration fill_interval = 3 [(validate.rules).duration = {
+    required: true
+    gt {}
+  }];
+}

envoy/type/v3alpha/token_bucket.proto

@@ -0,0 +1,37 @@
+syntax = "proto3";
+
+package envoy.type.v3alpha;
+
+import "google/protobuf/duration.proto";
+import "google/protobuf/wrappers.proto";
+
+import "udpa/annotations/versioning.proto";
+
+import "validate/validate.proto";
+
+option java_package = "io.envoyproxy.envoy.type.v3alpha";
+option java_outer_classname = "TokenBucketProto";
+option java_multiple_files = true;
+
+// [#protodoc-title: Token bucket]
+
+// Configures a token bucket, typically used for rate limiting.
+message TokenBucket {
+  option (udpa.annotations.versioning).previous_message_type = "envoy.type.TokenBucket";
+
+  // The maximum tokens that the bucket can hold. This is also the number of tokens that the bucket
+  // initially contains.
+  uint32 max_tokens = 1 [(validate.rules).uint32 = {gt: 0}];
+
+  // The number of tokens added to the bucket during each fill interval. If not specified, defaults
+  // to a single token.
+  google.protobuf.UInt32Value tokens_per_fill = 2 [(validate.rules).uint32 = {gt: 0}];
+
+  // The fill interval that tokens are added to the bucket. During each fill interval
+  // `tokens_per_fill` are added to the bucket. The bucket will never contain more than
+  // `max_tokens` tokens.
+  google.protobuf.Duration fill_interval = 3 [(validate.rules).duration = {
+    required: true
+    gt {}
+  }];
+}