如何应用 Nginx 入口速率限制？

Question

我正在尝试使用 nginx 入口速率限制对我的 AKS 实施速率限制功能。我刚刚在 nginx 入口资源中提供了limit-rps:10。不过，我没有看到预期的行为，即 rps * 默认突发率。有人可以帮助了解 nginx 中限速的工作原理以及如何在 nginx 资源中设置配置吗？

kind: Ingress
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"extensions/v1beta1","kind":"Ingress","metadata":{"annotations":{"kubernetes.io/ingress.class":"nginx","nginx.ingress.kubernetes.io/limit-rpm":"1","nginx.ingress.kubernetes.io/proxy-body-size":"30m","nginx.ingress.kubernetes.io/rewrite-target":"/$2","nginx.ingress.kubernetes.io/ssl-redirect":"false"},"name":"hop-ingress","namespace":"default"},"spec":{"rules":[{"http":{"paths":[{"backend":{"serviceName":"example-service","servicePort":80},"path":"/"}]}}]}}
    kubernetes.io/ingress.class: nginx
    nginx.ingress.kubernetes.io/limit-connections: "1"
    nginx.ingress.kubernetes.io/limit-rps: "1"
    nginx.ingress.kubernetes.io/proxy-body-size: 30m
    nginx.ingress.kubernetes.io/rewrite-target: /$2
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
  creationTimestamp: "2021-08-13T13:33:12Z"
  generation: 2
  name: hop-ingress
  namespace: default
  resourceVersion: "21201898"
  selfLink: /apis/extensions/v1beta1/namespaces/default/ingresses/hop-ingress
  uid: 574f4cf5-6b66-414f-ba2c-3c36c9d62ef0
spec:
  rules:
  - http:
      paths:
      - backend:
          serviceName: example-service
          servicePort: 80
        path: /
        pathType: ImplementationSpecific
  - http:
      paths:
      - backend:
          serviceName: productpage
          servicePort: 9080
        path: /productpage(/|$)(.*)
        pathType: ImplementationSpecific
status:
  loadBalancer:
    ingress:
    - ip: 13.71.57.131

Answer 1

limit-rps 是一个local rate limit settings，应用于特定的入口对象，而不是提供给入口控制器的配置映射。

它将限制每秒来自 IP 地址的请求数：

nginx.ingress.kubernetes.io/limit-rps：接受的请求数 每秒来自给定的 IP。突发限制设置为此限制 乘以突发乘数，默认乘数为 5。当 客户端超出此限制，limit-req-status-code 默认：503 是 返回。

请参阅下面的虚拟示例。如您所见，nginx.ingress.kubernetes.io/limit-rps: 10 已添加到入口对象的 metadata.annotations 下

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: minimal-ingress
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    nginx.ingress.kubernetes.io/limit-rps: 10
spec:
  rules:
  - http:
      paths:
      - path: /testpath
        pathType: Prefix
        backend:
          service:
            name: test
            port:
              number: 80

也可以申请global rate limiting，详情请看说明书