You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by yi...@apache.org on 2026/04/17 08:29:45 UTC
(apisix) branch master updated: docs: add ADC and Ingress Controller tabs to limit-req plugin docs (#13216)
This is an automated email from the ASF dual-hosted git repository.
yilialin pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git
The following commit(s) were added to refs/heads/master by this push:
new 8ddf4974d docs: add ADC and Ingress Controller tabs to limit-req plugin docs (#13216)
8ddf4974d is described below
commit 8ddf4974d8788309b733765e8fd0fc1719363bee
Author: Yilia Lin <11...@users.noreply.github.com>
AuthorDate: Fri Apr 17 16:29:39 2026 +0800
docs: add ADC and Ingress Controller tabs to limit-req plugin docs (#13216)
---
docs/en/latest/plugins/limit-req.md | 785 +++++++++++++++++++++++++++++++++--
docs/zh/latest/plugins/limit-req.md | 808 ++++++++++++++++++++++++++++++++++--
2 files changed, 1523 insertions(+), 70 deletions(-)
diff --git a/docs/en/latest/plugins/limit-req.md b/docs/en/latest/plugins/limit-req.md
index c271bc51c..44dc822ac 100644
--- a/docs/en/latest/plugins/limit-req.md
+++ b/docs/en/latest/plugins/limit-req.md
@@ -31,55 +31,79 @@ description: The limit-req Plugin uses the leaky bucket algorithm to rate limit
<link rel="canonical" href="https://docs.api7.ai/hub/limit-req" />
</head>
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
## Description
The `limit-req` Plugin uses the [leaky bucket](https://en.wikipedia.org/wiki/Leaky_bucket) algorithm to rate limit the number of the requests and allow for throttling.
+## Local vs Redis Rate Limiting
+
+The `limit-req` Plugin supports two modes of rate limiting:
+
+* **Local rate limiting**: Limits are enforced independently on each gateway instance. Each instance maintains its own counters, so the effective limit is roughly (limit × number of instances) when traffic is spread across instances. This is the default when no `policy` is set or when `policy` is `local`.
+* **Redis-based rate limiting**: Limits are shared across all gateway instances through Redis. All instances share the same quota, so the configured limit applies to all gateway instances.
+
## Attributes
-| Name | Type | Required | Default | Valid values | Description |
-|-------------------|---------|----------|---------|----------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| rate | integer | True | | > 0 | The maximum number of requests allowed per second. Requests exceeding the rate and below burst will be delayed. |
-| burst | integer | True | | >= 0 | The number of requests allowed to be delayed per second for throttling. Requests exceeding the rate and burst will get rejected. |
-| key_type | string | False | var | ["var", "var_combination"] | The type of key. If the `key_type` is `var`, the `key` is interpreted a variable. If the `key_type` is `var_combination`, the `key` is interpreted as a combination of variables. [...]
-| key | string | True | remote_addr | | The key to count requests by. If the `key_type` is `var`, the `key` is interpreted a variable. The variable does not need to be prefixed by a dollar sign (`$`). If the `key_type` is `var_combination`, the `key` is interpreted as a combination of variables. All variables should be prefixed by dollar signs (`$`). For example, to configure the `key` to use a combination of two request headers `custom-a` and `custom-b`, the `key` [...]
-| rejected_code | integer | False | 503 | [200,...,599] | The HTTP status code returned when a request is rejected for exceeding the threshold. |
-| rejected_msg | string | False | | non-empty | The response body returned when a request is rejected for exceeding the threshold. |
-| nodelay | boolean | False | false | | If true, do not delay requests within the burst threshold. |
-| allow_degradation | boolean | False | false | | If true, allow APISIX to continue handling requests without the Plugin when the Plugin or its dependencies become unavailable. |
-| policy | string | False | local | ["local", "redis", "redis-cluster"] | The policy for rate limiting counter. If it is `local`, the counter is stored in memory locally. If it is `redis`, the counter is stored on a Redis instance. If it is `redis-cluster`, the counter is stored in a Redis cluster. |
-| redis_host | string | False | | | The address of the Redis node. Required when `policy` is `redis`. |
-| redis_port | integer | False | 6379 | [1,...] | The port of the Redis node when `policy` is `redis`. |
-| redis_username | string | False | | | The username for Redis if Redis ACL is used. If you use the legacy authentication method `requirepass`, configure only the `redis_password`. Used when `policy` is `redis`. |
-| redis_password | string | False | | | The password of the Redis node when `policy` is `redis` or `redis-cluster`. |
-| redis_ssl | boolean | False | false | | If true, use SSL to connect to Redis cluster when `policy` is `redis`. |
-| redis_ssl_verify | boolean | False | false | | If true, verify the server SSL certificate when `policy` is `redis`. |
-| redis_database | integer | False | 0 | >= 0 | The database number in Redis when `policy` is `redis`. |
-| redis_timeout | integer | False | 1000 | [1,...] | The Redis timeout value in milliseconds when `policy` is `redis` or `redis-cluster`. |
-| redis_keepalive_timeout | integer | False | 10000 | ≥ 1000 | Keepalive timeout in milliseconds for redis when `policy` is `redis` or `redis-cluster`. |
-| redis_keepalive_pool | integer | False | 100 | ≥ 1 | Keepalive pool size for redis when `policy` is `redis` or `redis-cluster`. |
-| redis_cluster_nodes | array[string] | False | | | The list of the Redis cluster nodes with at least two addresses. Required when policy is redis-cluster. |
-| redis_cluster_name | string | False | | | The name of the Redis cluster. Required when `policy` is `redis-cluster`. |
-| redis_cluster_ssl | boolean | False | false | | If true, use SSL to connect to Redis cluster when `policy` is |
-| redis_cluster_ssl_verify | boolean | False | false | | If true, verify the server SSL certificate when `policy` is `redis-cluster`. |
+| Name | Type | Required | Default | Valid values | Description |
+|------|------|----------|---------|--------------|-------------|
+| rate | number | True | | > 0 | The maximum number of requests allowed per second. Requests exceeding the rate and below burst will be delayed. |
+| burst | number | True | | >= 0 | The number of requests allowed to be delayed per second for throttling. Requests exceeding the rate and burst will get rejected. |
+| key_type | string | False | var | ["var", "var_combination"] | The type of key. If the `key_type` is `var`, the `key` is interpreted as a variable. If the `key_type` is `var_combination`, the `key` is interpreted as a combination of variables. |
+| key | string | True | | | The key to count requests by. If the `key_type` is `var`, the `key` is interpreted as a variable. The variable does not need to be prefixed by a dollar sign (`$`). If the `key_type` is `var_combination`, the `key` is interpreted as a combination of variables. All variables should be prefixed by dollar signs (`$`). For example, to configure the `key` to use a combination of two request headers `custom-a` and `custom-b`, the `key` should be configured as `$http_ [...]
+| rejected_code | integer | False | 503 | [200,...,599] | The HTTP status code returned when a request is rejected for exceeding the threshold. |
+| rejected_msg | string | False | | non-empty | The response body returned when a request is rejected for exceeding the threshold. |
+| nodelay | boolean | False | false | | If true, do not delay requests within the burst threshold. |
+| allow_degradation | boolean | False | false | | If true, allow APISIX to continue handling requests without the Plugin when the Plugin or its dependencies become unavailable. |
+| policy | string | False | local | ["local", "redis", "redis-cluster"] | The policy for rate limiting counter. If it is `local`, the counter is stored in memory locally. If it is `redis`, the counter is stored on a Redis instance. If it is `redis-cluster`, the counter is stored in a Redis cluster. |
+| redis_host | string | False | | | The address of the Redis node. Required when `policy` is `redis`. |
+| redis_port | integer | False | 6379 | [1,...] | The port of the Redis node when `policy` is `redis`. |
+| redis_username | string | False | | | The username for Redis if Redis ACL is used. If you use the legacy authentication method `requirepass`, configure only the `redis_password`. Used when `policy` is `redis`. |
+| redis_password | string | False | | | The password of the Redis node when `policy` is `redis` or `redis-cluster`. |
+| redis_ssl | boolean | False | false | | If true, use SSL to connect to Redis when `policy` is `redis`. |
+| redis_ssl_verify | boolean | False | false | | If true, verify the server SSL certificate when `policy` is `redis`. |
+| redis_database | integer | False | 0 | >= 0 | The database number in Redis when `policy` is `redis`. |
+| redis_timeout | integer | False | 1000 | [1,...] | The Redis timeout value in milliseconds when `policy` is `redis` or `redis-cluster`. |
+| redis_keepalive_timeout | integer | False | 10000 | ≥ 1000 | Keepalive timeout in milliseconds for redis when `policy` is `redis` or `redis-cluster`. |
+| redis_keepalive_pool | integer | False | 100 | ≥ 1 | Keepalive pool size for redis when `policy` is `redis` or `redis-cluster`. |
+| redis_cluster_nodes | array[string] | False | | | The list of the Redis cluster nodes with at least one address. Required when policy is redis-cluster. |
+| redis_cluster_name | string | False | | | The name of the Redis cluster. Required when `policy` is `redis-cluster`. |
+| redis_cluster_ssl | boolean | False | false | | If true, use SSL to connect to Redis cluster when `policy` is `redis-cluster`. |
+| redis_cluster_ssl_verify | boolean | False | false | | If true, verify the server SSL certificate when `policy` is `redis-cluster`. |
## Examples
The examples below demonstrate how you can configure `limit-req` in different scenarios.
:::note
+
You can fetch the `admin_key` from `config.yaml` and save to an environment variable with the following command:
```bash
admin_key=$(yq '.deployment.admin.admin_key[0].key' conf/config.yaml | sed 's/"//g')
```
+:::
+
### Apply Rate Limiting by Remote Address
The following example demonstrates the rate limiting of HTTP requests by a single variable, `remote_addr`.
Create a Route with `limit-req` Plugin that allows for 1 QPS per remote address:
+<Tabs
+groupId="api"
+defaultValue="admin-api"
+values={[
+{label: 'Admin API', value: 'admin-api'},
+{label: 'ADC', value: 'adc'},
+{label: 'Ingress Controller', value: 'aic'}
+]}>
+
+<TabItem value="admin-api">
+
```shell
curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
-H "X-API-KEY: ${admin_key}" \
@@ -94,6 +118,7 @@ curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
"key": "remote_addr",
"key_type": "var",
"rejected_code": 429,
+ "policy": "local",
"nodelay": true
}
},
@@ -106,6 +131,169 @@ curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
}'
```
+</TabItem>
+
+<TabItem value="adc">
+
+```yaml title="adc.yaml"
+services:
+ - name: httpbin
+ routes:
+ - uris:
+ - /get
+ name: limit-req-route
+ plugins:
+ limit-req:
+ rate: 1
+ burst: 0
+ key: remote_addr
+ key_type: var
+ rejected_code: 429
+ policy: local
+ nodelay: true
+ upstream:
+ type: roundrobin
+ nodes:
+ - host: httpbin.org
+ port: 80
+ weight: 1
+```
+
+Synchronize the configuration to the gateway:
+
+```shell
+adc sync -f adc.yaml
+```
+
+</TabItem>
+
+<TabItem value="aic">
+
+<Tabs
+groupId="k8s-api"
+defaultValue="gateway-api"
+values={[
+{label: 'Gateway API', value: 'gateway-api'},
+{label: 'APISIX CRD', value: 'apisix-crd'}
+]}>
+
+<TabItem value="gateway-api">
+
+```yaml title="limit-req-ic.yaml"
+apiVersion: v1
+kind: Service
+metadata:
+ namespace: aic
+ name: httpbin-external-domain
+spec:
+ type: ExternalName
+ externalName: httpbin.org
+---
+apiVersion: apisix.apache.org/v1alpha1
+kind: PluginConfig
+metadata:
+ namespace: aic
+ name: limit-req-plugin-config
+spec:
+ plugins:
+ - name: limit-req
+ config:
+ rate: 1
+ burst: 0
+ key: remote_addr
+ key_type: var
+ rejected_code: 429
+ policy: local
+ nodelay: true
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+ namespace: aic
+ name: limit-req-route
+spec:
+ parentRefs:
+ - name: apisix
+ rules:
+ - matches:
+ - path:
+ type: Exact
+ value: /get
+ filters:
+ - type: ExtensionRef
+ extensionRef:
+ group: apisix.apache.org
+ kind: PluginConfig
+ name: limit-req-plugin-config
+ backendRefs:
+ - name: httpbin-external-domain
+ port: 80
+```
+
+</TabItem>
+
+<TabItem value="apisix-crd">
+
+```yaml title="limit-req-ic.yaml"
+apiVersion: apisix.apache.org/v2
+kind: ApisixUpstream
+metadata:
+ namespace: aic
+ name: httpbin-external-domain
+spec:
+ ingressClassName: apisix
+ externalNodes:
+ - type: Domain
+ name: httpbin.org
+---
+apiVersion: apisix.apache.org/v2
+kind: ApisixRoute
+metadata:
+ namespace: aic
+ name: limit-req-route
+spec:
+ ingressClassName: apisix
+ http:
+ - name: limit-req-route
+ match:
+ paths:
+ - /get
+ methods:
+ - GET
+ upstreams:
+ - name: httpbin-external-domain
+ plugins:
+ - name: limit-req
+ config:
+ rate: 1
+ burst: 0
+ key: remote_addr
+ key_type: var
+ rejected_code: 429
+ policy: local
+ nodelay: true
+```
+
+</TabItem>
+
+</Tabs>
+
+Apply the configuration:
+
+```shell
+kubectl apply -f limit-req-ic.yaml
+```
+
+</TabItem>
+
+</Tabs>
+
+❶ `rate`: limit the QPS to 1.
+
+❷ `key`: set to `remote_addr` to apply rate limiting quota by remote address.
+
+❸ `key_type`: set to `var` to interpret the `key` as a variable.
+
Send a request to verify:
```shell
@@ -122,6 +310,17 @@ The following example demonstrates how to configure `burst` to allow overrun of
Create a Route with `limit-req` Plugin that allows for 1 QPS per remote address, with a `burst` of 1 to allow for 1 request exceeding the `rate` to be delayed for processing:
+<Tabs
+groupId="api"
+defaultValue="admin-api"
+values={[
+{label: 'Admin API', value: 'admin-api'},
+{label: 'ADC', value: 'adc'},
+{label: 'Ingress Controller', value: 'aic'}
+]}>
+
+<TabItem value="admin-api">
+
```shell
curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
-H "X-API-KEY: ${admin_key}" \
@@ -133,7 +332,8 @@ curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
"rate": 1,
"burst": 1,
"key": "remote_addr",
- "rejected_code": 429
+ "rejected_code": 429,
+ "policy": "local"
}
},
"upstream": {
@@ -145,6 +345,159 @@ curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
}'
```
+</TabItem>
+
+<TabItem value="adc">
+
+```yaml title="adc.yaml"
+services:
+ - name: httpbin
+ routes:
+ - uris:
+ - /get
+ name: limit-req-route
+ plugins:
+ limit-req:
+ rate: 1
+ burst: 1
+ key: remote_addr
+ rejected_code: 429
+ policy: local
+ upstream:
+ type: roundrobin
+ nodes:
+ - host: httpbin.org
+ port: 80
+ weight: 1
+```
+
+Synchronize the configuration to the gateway:
+
+```shell
+adc sync -f adc.yaml
+```
+
+</TabItem>
+
+<TabItem value="aic">
+
+<Tabs
+groupId="k8s-api"
+defaultValue="gateway-api"
+values={[
+{label: 'Gateway API', value: 'gateway-api'},
+{label: 'APISIX CRD', value: 'apisix-crd'}
+]}>
+
+<TabItem value="gateway-api">
+
+```yaml title="limit-req-ic.yaml"
+apiVersion: v1
+kind: Service
+metadata:
+ namespace: aic
+ name: httpbin-external-domain
+spec:
+ type: ExternalName
+ externalName: httpbin.org
+---
+apiVersion: apisix.apache.org/v1alpha1
+kind: PluginConfig
+metadata:
+ namespace: aic
+ name: limit-req-plugin-config
+spec:
+ plugins:
+ - name: limit-req
+ config:
+ rate: 1
+ burst: 1
+ key: remote_addr
+ rejected_code: 429
+ policy: local
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+ namespace: aic
+ name: limit-req-route
+spec:
+ parentRefs:
+ - name: apisix
+ rules:
+ - matches:
+ - path:
+ type: Exact
+ value: /get
+ filters:
+ - type: ExtensionRef
+ extensionRef:
+ group: apisix.apache.org
+ kind: PluginConfig
+ name: limit-req-plugin-config
+ backendRefs:
+ - name: httpbin-external-domain
+ port: 80
+```
+
+</TabItem>
+
+<TabItem value="apisix-crd">
+
+```yaml title="limit-req-ic.yaml"
+apiVersion: apisix.apache.org/v2
+kind: ApisixUpstream
+metadata:
+ namespace: aic
+ name: httpbin-external-domain
+spec:
+ ingressClassName: apisix
+ externalNodes:
+ - type: Domain
+ name: httpbin.org
+---
+apiVersion: apisix.apache.org/v2
+kind: ApisixRoute
+metadata:
+ namespace: aic
+ name: limit-req-route
+spec:
+ ingressClassName: apisix
+ http:
+ - name: limit-req-route
+ match:
+ paths:
+ - /get
+ methods:
+ - GET
+ upstreams:
+ - name: httpbin-external-domain
+ plugins:
+ - name: limit-req
+ config:
+ rate: 1
+ burst: 1
+ key: remote_addr
+ rejected_code: 429
+ policy: local
+```
+
+</TabItem>
+
+</Tabs>
+
+Apply the configuration:
+
+```shell
+kubectl apply -f limit-req-ic.yaml
+```
+
+</TabItem>
+
+</Tabs>
+
+❶ `burst`: allow for 1 request exceeding the `rate` to be delayed for processing.
+
Generate three requests to the Route:
```shell
@@ -162,6 +515,17 @@ You are likely to see that all three requests are successful:
To see the effect without `burst`, update `burst` to 0 or set `nodelay` to `true` as follows:
+<Tabs
+groupId="api"
+defaultValue="admin-api"
+values={[
+{label: 'Admin API', value: 'admin-api'},
+{label: 'ADC', value: 'adc'},
+{label: 'Ingress Controller', value: 'aic'}
+]}>
+
+<TabItem value="admin-api">
+
```shell
curl "http://127.0.0.1:9180/apisix/admin/routes/limit-req-route" -X PATCH \
-H "X-API-KEY: ${admin_key}" \
@@ -174,6 +538,121 @@ curl "http://127.0.0.1:9180/apisix/admin/routes/limit-req-route" -X PATCH \
}'
```
+</TabItem>
+
+<TabItem value="adc">
+
+Update the ADC YAML with `nodelay: true`:
+
+```yaml title="adc.yaml"
+services:
+ - name: httpbin
+ routes:
+ - uris:
+ - /get
+ name: limit-req-route
+ plugins:
+ limit-req:
+ rate: 1
+ burst: 1 # alternatively, set burst to 0
+ key: remote_addr
+ rejected_code: 429
+ policy: local
+ nodelay: true
+ upstream:
+ type: roundrobin
+ nodes:
+ - host: httpbin.org
+ port: 80
+ weight: 1
+```
+
+Synchronize the configuration with updated plugin settings:
+
+```shell
+adc sync -f adc.yaml
+```
+
+</TabItem>
+
+<TabItem value="aic">
+
+Update the manifest file as such:
+
+<Tabs
+groupId="k8s-api"
+defaultValue="gateway-api"
+values={[
+{label: 'Gateway API', value: 'gateway-api'},
+{label: 'APISIX CRD', value: 'apisix-crd'}
+]}>
+
+<TabItem value="gateway-api">
+
+```yaml title="limit-req-ic.yaml"
+apiVersion: apisix.apache.org/v1alpha1
+kind: PluginConfig
+metadata:
+ namespace: aic
+ name: limit-req-plugin-config
+spec:
+ plugins:
+ - name: limit-req
+ config:
+ rate: 1
+ burst: 1 # alternatively, set burst to 0
+ key: remote_addr
+ rejected_code: 429
+ policy: local
+ nodelay: true
+```
+
+</TabItem>
+
+<TabItem value="apisix-crd">
+
+```yaml title="limit-req-ic.yaml"
+apiVersion: apisix.apache.org/v2
+kind: ApisixRoute
+metadata:
+ namespace: aic
+ name: limit-req-route
+spec:
+ ingressClassName: apisix
+ http:
+ - name: limit-req-route
+ match:
+ paths:
+ - /get
+ methods:
+ - GET
+ upstreams:
+ - name: httpbin-external-domain
+ plugins:
+ - name: limit-req
+ config:
+ rate: 1
+ burst: 1 # alternatively, set burst to 0
+ key: remote_addr
+ rejected_code: 429
+ policy: local
+ nodelay: true
+```
+
+</TabItem>
+
+</Tabs>
+
+Apply the updated configuration:
+
+```shell
+kubectl apply -f limit-req-ic.yaml
+```
+
+</TabItem>
+
+</Tabs>
+
Generate three requests to the Route again:
```shell
@@ -195,6 +674,17 @@ The following example demonstrates the rate limiting of requests by a combinatio
Create a Route with `limit-req` Plugin that allows for 1 QPS per remote address and for each Consumer.
+<Tabs
+groupId="api"
+defaultValue="admin-api"
+values={[
+{label: 'Admin API', value: 'admin-api'},
+{label: 'ADC', value: 'adc'},
+{label: 'Ingress Controller', value: 'aic'}
+]}>
+
+<TabItem value="admin-api">
+
Create a Consumer `john`:
```shell
@@ -245,7 +735,7 @@ curl "http://127.0.0.1:9180/apisix/admin/consumers/jane/credentials" -X PUT \
}'
```
-Create a Route with `key-auth` and `limit-req` Plugins, and specify in the `limit-req` Plugin to use a combination of variables as the rate-limiting key:
+Create a Route with `key-auth` and `limit-req` Plugins:
```shell
curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
@@ -260,7 +750,8 @@ curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
"burst": 0,
"key": "$remote_addr $consumer_name",
"key_type": "var_combination",
- "rejected_code": 429
+ "rejected_code": 429,
+ "policy": "local"
}
},
"upstream": {
@@ -272,6 +763,244 @@ curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
}'
```
+</TabItem>
+
+<TabItem value="adc">
+
+Create two Consumers and a Route that enables rate limiting by Consumers:
+
+```yaml title="adc.yaml"
+consumers:
+ - username: john
+ credentials:
+ - name: key-auth
+ type: key-auth
+ config:
+ key: john-key
+ - username: jane
+ credentials:
+ - name: key-auth
+ type: key-auth
+ config:
+ key: jane-key
+services:
+ - name: limit-req-service
+ routes:
+ - name: limit-req-route
+ uris:
+ - /get
+ plugins:
+ key-auth: {}
+ limit-req:
+ rate: 1
+ burst: 0
+ key: "$remote_addr $consumer_name"
+ key_type: var_combination
+ rejected_code: 429
+ policy: local
+ upstream:
+ type: roundrobin
+ nodes:
+ - host: httpbin.org
+ port: 80
+ weight: 1
+```
+
+Synchronize the configuration to the gateway:
+
+```shell
+adc sync -f adc.yaml
+```
+
+</TabItem>
+
+<TabItem value="aic">
+
+Create two Consumers and a Route that enables rate limiting by Consumers:
+
+<Tabs
+groupId="k8s-api"
+defaultValue="gateway-api"
+values={[
+{label: 'Gateway API', value: 'gateway-api'},
+{label: 'APISIX CRD', value: 'apisix-crd'}
+]}>
+
+<TabItem value="gateway-api">
+
+```yaml title="limit-req-ic.yaml"
+apiVersion: apisix.apache.org/v1alpha1
+kind: Consumer
+metadata:
+ namespace: aic
+ name: john
+spec:
+ gatewayRef:
+ name: apisix
+ credentials:
+ - type: key-auth
+ name: primary-key
+ config:
+ key: john-key
+---
+apiVersion: apisix.apache.org/v1alpha1
+kind: Consumer
+metadata:
+ namespace: aic
+ name: jane
+spec:
+ gatewayRef:
+ name: apisix
+ credentials:
+ - type: key-auth
+ name: primary-key
+ config:
+ key: jane-key
+---
+apiVersion: v1
+kind: Service
+metadata:
+ namespace: aic
+ name: httpbin-external-domain
+spec:
+ type: ExternalName
+ externalName: httpbin.org
+---
+apiVersion: apisix.apache.org/v1alpha1
+kind: PluginConfig
+metadata:
+ namespace: aic
+ name: limit-req-plugin-config
+spec:
+ plugins:
+ - name: key-auth
+ config:
+ _meta:
+ disable: false
+ - name: limit-req
+ config:
+ rate: 1
+ burst: 0
+ key: "$remote_addr $consumer_name"
+ key_type: var_combination
+ rejected_code: 429
+ policy: local
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+ namespace: aic
+ name: limit-req-route
+spec:
+ parentRefs:
+ - name: apisix
+ rules:
+ - matches:
+ - path:
+ type: Exact
+ value: /get
+ filters:
+ - type: ExtensionRef
+ extensionRef:
+ group: apisix.apache.org
+ kind: PluginConfig
+ name: limit-req-plugin-config
+ backendRefs:
+ - name: httpbin-external-domain
+ port: 80
+```
+
+</TabItem>
+
+<TabItem value="apisix-crd">
+
+```yaml title="limit-req-ic.yaml"
+apiVersion: apisix.apache.org/v2
+kind: ApisixConsumer
+metadata:
+ namespace: aic
+ name: john
+spec:
+ ingressClassName: apisix
+ authParameter:
+ keyAuth:
+ value:
+ key: john-key
+---
+apiVersion: apisix.apache.org/v2
+kind: ApisixConsumer
+metadata:
+ namespace: aic
+ name: jane
+spec:
+ ingressClassName: apisix
+ authParameter:
+ keyAuth:
+ value:
+ key: jane-key
+---
+apiVersion: apisix.apache.org/v2
+kind: ApisixUpstream
+metadata:
+ namespace: aic
+ name: httpbin-external-domain
+spec:
+ ingressClassName: apisix
+ externalNodes:
+ - type: Domain
+ name: httpbin.org
+---
+apiVersion: apisix.apache.org/v2
+kind: ApisixRoute
+metadata:
+ namespace: aic
+ name: limit-req-route
+spec:
+ ingressClassName: apisix
+ http:
+ - name: limit-req-route
+ match:
+ paths:
+ - /get
+ methods:
+ - GET
+ upstreams:
+ - name: httpbin-external-domain
+ plugins:
+ - name: key-auth
+ config:
+ _meta:
+ disable: false
+ - name: limit-req
+ config:
+ rate: 1
+ burst: 0
+ key: "$remote_addr $consumer_name"
+ key_type: var_combination
+ rejected_code: 429
+ policy: local
+```
+
+</TabItem>
+
+</Tabs>
+
+Apply the configuration:
+
+```shell
+kubectl apply -f limit-req-ic.yaml
+```
+
+</TabItem>
+
+</Tabs>
+
+❶ `key-auth`: enable key authentication on the Route.
+
+❷ `key`: set to `$remote_addr $consumer_name` to apply rate limiting quota by remote address and Consumer.
+
+❸ `key_type`: set to `var_combination` to interpret the `key` as a combination of variables.
+
Send two requests simultaneously, each for one Consumer:
```shell
diff --git a/docs/zh/latest/plugins/limit-req.md b/docs/zh/latest/plugins/limit-req.md
index 26e794eb2..ff88087b1 100644
--- a/docs/zh/latest/plugins/limit-req.md
+++ b/docs/zh/latest/plugins/limit-req.md
@@ -4,7 +4,7 @@ keywords:
- APISIX
- API 网关
- Limit Request
- - limit-req
+ - 速率限制
description: limit-req 插件使用漏桶算法来限制请求的数量并允许节流。
---
@@ -31,39 +31,47 @@ description: limit-req 插件使用漏桶算法来限制请求的数量并允许
<link rel="canonical" href="https://docs.api7.ai/hub/limit-req" />
</head>
+import Tabs from '@theme/Tabs';
+import TabItem from '@theme/TabItem';
+
## 描述
-`limit-req` 插件使用 [leaky bucket](https://en.wikipedia.org/wiki/Leaky_bucket) 算法来限制请求的数量并允许节流。
+`limit-req` 插件使用[漏桶](https://en.wikipedia.org/wiki/Leaky_bucket)算法来限制请求的数量并允许节流。
+
+## 本地 vs Redis 速率限制
+
+`limit-req` 插件支持两种速率限制模式：
+
+* **本地速率限制**：限制在每个网关实例上独立执行。每个实例维护自己的计数器，因此当流量分布在多个实例之间时，有效限制大约为（限制 × 实例数量）。当未设置 `policy` 或 `policy` 为 `local` 时，这是默认模式。
+* **基于 Redis 的速率限制**：限制通过 Redis 在所有网关实例之间共享。所有实例共享相同的配额，因此配置的限制适用于所有网关实例。
## 属性
-| 名称 | 类型 | 必选项 | 默认值 | 有效值 | 描述 |
-| ------------- | ------- | ------ | ------ | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
-| rate | integer | True | | > 0 | 每秒允许的最大请求数。超过速率且低于突发的请求将被延迟。|
-| bust | integer | True | | >= 0 | 每秒允许延迟的请求数，以进行限制。超过速率和突发的请求将被拒绝。|
-| key_type | string | 否 | var | ["var","var_combination"] | key 的类型。如果 `key_type` 为 `var`，则 `key` 将被解释为变量。如果 `key_type` 为 `var_combination`，则 `key` 将被解释为变量的组合。 |
-| key | string | 否 | remote_addr | | 用于计数请求的 key。如果 `key_type` 为 `var`，则 `key` 将被解释为变量。变量不需要以美元符号（`$`）为前缀。如果 `key_type` 为 `var_combination`，则 `key` 会被解释为变量的组合。所有变量都应该以美元符号 (`$`) 为前缀。例如，要配置 `key` 使用两个请求头 `custom-a` 和 `custom-b` 的组合，则 `key` 应该配置为 `$http_custom_a $http_custom_b`。如果 `key_type` 为 `constant`，则 `key` 会被解释为常量值。|
+| 名称 | 类型 | 必选项 | 默认值 | 有效值 | 描述 |
+|------|------|----------|---------|--------------|-------------|
+| rate | number | 是 | | > 0 | 每秒允许的最大请求数。超过速率且低于突发的请求将被延迟。|
+| burst | number | 是 | | >= 0 | 每秒允许延迟的请求数，以进行节流。超过速率和突发的请求将被拒绝。|
+| key_type | string | 否 | var | ["var", "var_combination"] | key 的类型。如果 `key_type` 为 `var`，则 `key` 将被解释为变量。如果 `key_type` 为 `var_combination`，则 `key` 将被解释为变量的组合。|
+| key | string | 是 | | | 用于计数请求的 key。如果 `key_type` 为 `var`，则 `key` 将被解释为变量。变量不需要以美元符号（`$`）为前缀。如果 `key_type` 为 `var_combination`，则 `key` 会被解释为变量的组合。所有变量都应该以美元符号（`$`）为前缀。例如，要配置 `key` 使用两个请求头 `custom-a` 和 `custom-b` 的组合，则 `key` 应该配置为 `$http_custom_a $http_custom_b`。|
| rejected_code | integer | 否 | 503 | [200,...,599] | 请求因超出阈值而被拒绝时返回的 HTTP 状态代码。|
-| rejection_msg | string | 否 | | 非空 | 请求因超出阈值而被拒绝时返回的响应主体。|
-| nodelay | boolean | 否 | false | | 如果为 true，则不要延迟突发阈值内的请求。 |
+| rejected_msg | string | 否 | | 非空 | 请求因超出阈值而被拒绝时返回的响应主体。|
+| nodelay | boolean | 否 | false | | 如果为 true，则不延迟突发阈值内的请求。|
| allow_degradation | boolean | 否 | false | | 如果为 true，则允许 APISIX 在插件或其依赖项不可用时继续处理没有插件的请求。|
-| policy | string | 否 | local | ["local","redis","redis-cluster"] | 速率限制计数器的策略。如果是 `local`，则计数器存储在本地内存中。如果是 `redis`，则计数器存储在 Redis 实例上。如果是 `redis-cluster`，则计数器存储在 Redis 集群中。|
-| allow_degradation | boolean | 否 | false | | 如果为 true，则允许 APISIX 在插件或其依赖项不可用时继续处理没有插件的请求。|
-| show_limit_quota_header | boolean | 否 | true | | 如果为 true，则在响应标头中包含 `X-RateLimit-Limit` 以显示总配额和 `X-RateLimit-Remaining` 以显示剩余配额。|
-| redis_host | string | 否 | | | Redis 节点的地址。当 `policy` 为 `redis` 时必填。 |
-| redis_port | integer | 否 | 6379 | [1,...] | 当 `policy` 为 `redis` 时，Redis 节点的端口。 |
-| redis_username | string | 否 | | | 如果使用 Redis ACL，则为 Redis 的用户名。如果使用旧式身份验证方法 `requirepass`，则仅配置 `redis_password`。当 `policy` 为 `redis` 时使用。 |
-| redis_password | string | 否 | | | 当 `policy` 为 `redis` 或 `redis-cluster` 时，Redis 节点的密码。 |
-| redis_ssl | boolean | 否 | false |如果为 true，则在 `policy` 为 `redis` 时使用 SSL 连接到 Redis 集群。|
+| policy | string | 否 | local | ["local", "redis", "redis-cluster"] | 速率限制计数器的策略。如果是 `local`，则计数器存储在本地内存中。如果是 `redis`，则计数器存储在 Redis 实例上。如果是 `redis-cluster`，则计数器存储在 Redis 集群中。|
+| redis_host | string | 否 | | | Redis 节点的地址。当 `policy` 为 `redis` 时必填。|
+| redis_port | integer | 否 | 6379 | [1,...] | 当 `policy` 为 `redis` 时，Redis 节点的端口。|
+| redis_username | string | 否 | | | 如果使用 Redis ACL，则为 Redis 的用户名。如果使用旧式身份验证方法 `requirepass`，则仅配置 `redis_password`。当 `policy` 为 `redis` 时使用。|
+| redis_password | string | 否 | | | 当 `policy` 为 `redis` 或 `redis-cluster` 时，Redis 节点的密码。|
+| redis_ssl | boolean | 否 | false | | 如果为 true，则在 `policy` 为 `redis` 时使用 SSL 连接到 Redis。|
| redis_ssl_verify | boolean | 否 | false | | 如果为 true，则在 `policy` 为 `redis` 时验证服务器 SSL 证书。|
| redis_database | integer | 否 | 0 | >= 0 | 当 `policy` 为 `redis` 时，Redis 中的数据库编号。|
-| redis_timeout | integer | 否 | 1000 | [1,...] | 当 `policy` 为 `redis` 或 `redis-cluster` 时，Redis 超时值（以毫秒为单位）。 |
-| redis_keepalive_timeout | integer | 否 | 10000 | ≥ 1000 | 当 `policy` 为 `redis` 或 `redis-cluster` 时，与 `redis` 或 `redis-cluster` 的空闲连接超时时间，单位为毫秒。|
-| redis_keepalive_pool | integer | 否 | 100 | ≥ 1 | 当 `policy` 为 `redis` 或 `redis-cluster` 时，与 `redis` 或 `redis-cluster` 的连接池最大连接数。|
-| redis_cluster_nodes | array[string] | 否 | | | 具有至少两个地址的 Redis 群集节点列表。当 policy 为 redis-cluster 时必填。 |
-redis_cluster_name | string | 否 | | | | Redis 集群的名称。当 `policy` 为 `redis-cluster` 时必须使用。|
-| redis_cluster_ssl | boolean | 否 | false | | 如果为 `true`，当 `policy` 为 `redis-cluster`时，使用 SSL 连接 Redis 集群。|
-| redis_cluster_ssl_verify | boolean | 否 | false | | 如果为 `true`，当 `policy` 为 `redis-cluster` 时，验证服务器 SSL 证书。 |
+| redis_timeout | integer | 否 | 1000 | [1,...] | 当 `policy` 为 `redis` 或 `redis-cluster` 时，Redis 超时值（以毫秒为单位）。|
+| redis_keepalive_timeout | integer | 否 | 10000 | ≥ 1000 | 当 `policy` 为 `redis` 或 `redis-cluster` 时，与 Redis 的空闲连接超时时间，单位为毫秒。|
+| redis_keepalive_pool | integer | 否 | 100 | ≥ 1 | 当 `policy` 为 `redis` 或 `redis-cluster` 时，与 Redis 的连接池最大连接数。|
+| redis_cluster_nodes | array[string] | 否 | | | 具有至少一个地址的 Redis 集群节点列表。当 policy 为 redis-cluster 时必填。|
+| redis_cluster_name | string | 否 | | | Redis 集群的名称。当 `policy` 为 `redis-cluster` 时必须使用。|
+| redis_cluster_ssl | boolean | 否 | false | | 如果为 `true`，当 `policy` 为 `redis-cluster` 时，使用 SSL 连接 Redis 集群。|
+| redis_cluster_ssl_verify | boolean | 否 | false | | 如果为 `true`，当 `policy` 为 `redis-cluster` 时，验证服务器 SSL 证书。|
## 示例
@@ -71,7 +79,7 @@ redis_cluster_name | string | 否 | | | | Redis 集群的名称。当 `policy`
:::note
-您可以这样从 `config.yaml` 中获取 `admin_key` 并存入环境变量：
+你可以这样从 `config.yaml` 中获取 `admin_key` 并存入环境变量：
```bash
admin_key=$(yq '.deployment.admin.admin_key[0].key' conf/config.yaml | sed 's/"//g')
@@ -79,12 +87,23 @@ admin_key=$(yq '.deployment.admin.admin_key[0].key' conf/config.yaml | sed 's/"/
:::
-### 通过远程地址应用速率限制
+### 按远程地址应用速率限制
以下示例演示了通过单个变量 `remote_addr` 对 HTTP 请求进行速率限制。
使用 `limit-req` 插件创建允许每个远程地址 1 QPS 的路由：
+<Tabs
+groupId="api"
+defaultValue="admin-api"
+values={[
+{label: 'Admin API', value: 'admin-api'},
+{label: 'ADC', value: 'adc'},
+{label: 'Ingress Controller', value: 'aic'}
+]}>
+
+<TabItem value="admin-api">
+
```shell
curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
-H "X-API-KEY: ${admin_key}" \
@@ -99,6 +118,7 @@ curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
"key": "remote_addr",
"key_type": "var",
"rejected_code": 429,
+ "policy": "local",
"nodelay": true
}
},
@@ -111,22 +131,196 @@ curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
}'
```
+</TabItem>
+
+<TabItem value="adc">
+
+```yaml title="adc.yaml"
+services:
+ - name: httpbin
+ routes:
+ - uris:
+ - /get
+ name: limit-req-route
+ plugins:
+ limit-req:
+ rate: 1
+ burst: 0
+ key: remote_addr
+ key_type: var
+ rejected_code: 429
+ policy: local
+ nodelay: true
+ upstream:
+ type: roundrobin
+ nodes:
+ - host: httpbin.org
+ port: 80
+ weight: 1
+```
+
+将配置同步到网关：
+
+```shell
+adc sync -f adc.yaml
+```
+
+</TabItem>
+
+<TabItem value="aic">
+
+<Tabs
+groupId="k8s-api"
+defaultValue="gateway-api"
+values={[
+{label: 'Gateway API', value: 'gateway-api'},
+{label: 'APISIX CRD', value: 'apisix-crd'}
+]}>
+
+<TabItem value="gateway-api">
+
+```yaml title="limit-req-ic.yaml"
+apiVersion: v1
+kind: Service
+metadata:
+ namespace: aic
+ name: httpbin-external-domain
+spec:
+ type: ExternalName
+ externalName: httpbin.org
+---
+apiVersion: apisix.apache.org/v1alpha1
+kind: PluginConfig
+metadata:
+ namespace: aic
+ name: limit-req-plugin-config
+spec:
+ plugins:
+ - name: limit-req
+ config:
+ rate: 1
+ burst: 0
+ key: remote_addr
+ key_type: var
+ rejected_code: 429
+ policy: local
+ nodelay: true
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+ namespace: aic
+ name: limit-req-route
+spec:
+ parentRefs:
+ - name: apisix
+ rules:
+ - matches:
+ - path:
+ type: Exact
+ value: /get
+ filters:
+ - type: ExtensionRef
+ extensionRef:
+ group: apisix.apache.org
+ kind: PluginConfig
+ name: limit-req-plugin-config
+ backendRefs:
+ - name: httpbin-external-domain
+ port: 80
+```
+
+</TabItem>
+
+<TabItem value="apisix-crd">
+
+```yaml title="limit-req-ic.yaml"
+apiVersion: apisix.apache.org/v2
+kind: ApisixUpstream
+metadata:
+ namespace: aic
+ name: httpbin-external-domain
+spec:
+ ingressClassName: apisix
+ externalNodes:
+ - type: Domain
+ name: httpbin.org
+---
+apiVersion: apisix.apache.org/v2
+kind: ApisixRoute
+metadata:
+ namespace: aic
+ name: limit-req-route
+spec:
+ ingressClassName: apisix
+ http:
+ - name: limit-req-route
+ match:
+ paths:
+ - /get
+ methods:
+ - GET
+ upstreams:
+ - name: httpbin-external-domain
+ plugins:
+ - name: limit-req
+ config:
+ rate: 1
+ burst: 0
+ key: remote_addr
+ key_type: var
+ rejected_code: 429
+ policy: local
+ nodelay: true
+```
+
+</TabItem>
+
+</Tabs>
+
+应用配置：
+
+```shell
+kubectl apply -f limit-req-ic.yaml
+```
+
+</TabItem>
+
+</Tabs>
+
+❶ `rate`：将 QPS 限制为 1。
+
+❷ `key`：设置为 `remote_addr`，以按远程地址应用速率限制配额。
+
+❸ `key_type`：设置为 `var`，以将 `key` 解释为变量。
+
发送请求以验证：
```shell
curl -i "http://127.0.0.1:9080/get"
```
-您应该会看到一个 `HTTP/1.1 200 OK` 响应。
+你应该会看到一个 `HTTP/1.1 200 OK` 响应。
-该请求已消耗了时间窗口允许的所有配额。如果您在同一秒内再次发送请求，您应该会收到 `HTTP/1.1 429 Too Many Requests` 响应，表示请求超出了配额阈值。
+该请求已消耗了时间窗口允许的所有配额。如果你在同一秒内再次发送请求，你应该会收到 `HTTP/1.1 429 Too Many Requests` 响应，表示请求超出了配额阈值。
-### 允许速率限制阈值
+### 实现 API 节流
-以下示例演示了如何配置 `burst` 以允许速率限制阈值超出配置的值并实现请求限制。您还将看到与未实施限制时的比较。
+以下示例演示了如何配置 `burst` 以允许超出配置值的速率限制阈值并实现请求节流。你还将看到与未实施节流时的比较。
使用 `limit-req` 插件创建一个路由，允许每个远程地址 1 QPS，并将 `burst` 设置为 1，以允许 1 个超过 `rate` 的请求延迟处理：
+<Tabs
+groupId="api"
+defaultValue="admin-api"
+values={[
+{label: 'Admin API', value: 'admin-api'},
+{label: 'ADC', value: 'adc'},
+{label: 'Ingress Controller', value: 'aic'}
+]}>
+
+<TabItem value="admin-api">
+
```shell
curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
-H "X-API-KEY: ${admin_key}" \
@@ -138,7 +332,8 @@ curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
"rate": 1,
"burst": 1,
"key": "remote_addr",
- "rejected_code": 429
+ "rejected_code": 429,
+ "policy": "local"
}
},
"upstream": {
@@ -150,6 +345,159 @@ curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
}'
```
+</TabItem>
+
+<TabItem value="adc">
+
+```yaml title="adc.yaml"
+services:
+ - name: httpbin
+ routes:
+ - uris:
+ - /get
+ name: limit-req-route
+ plugins:
+ limit-req:
+ rate: 1
+ burst: 1
+ key: remote_addr
+ rejected_code: 429
+ policy: local
+ upstream:
+ type: roundrobin
+ nodes:
+ - host: httpbin.org
+ port: 80
+ weight: 1
+```
+
+将配置同步到网关：
+
+```shell
+adc sync -f adc.yaml
+```
+
+</TabItem>
+
+<TabItem value="aic">
+
+<Tabs
+groupId="k8s-api"
+defaultValue="gateway-api"
+values={[
+{label: 'Gateway API', value: 'gateway-api'},
+{label: 'APISIX CRD', value: 'apisix-crd'}
+]}>
+
+<TabItem value="gateway-api">
+
+```yaml title="limit-req-ic.yaml"
+apiVersion: v1
+kind: Service
+metadata:
+ namespace: aic
+ name: httpbin-external-domain
+spec:
+ type: ExternalName
+ externalName: httpbin.org
+---
+apiVersion: apisix.apache.org/v1alpha1
+kind: PluginConfig
+metadata:
+ namespace: aic
+ name: limit-req-plugin-config
+spec:
+ plugins:
+ - name: limit-req
+ config:
+ rate: 1
+ burst: 1
+ key: remote_addr
+ rejected_code: 429
+ policy: local
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+ namespace: aic
+ name: limit-req-route
+spec:
+ parentRefs:
+ - name: apisix
+ rules:
+ - matches:
+ - path:
+ type: Exact
+ value: /get
+ filters:
+ - type: ExtensionRef
+ extensionRef:
+ group: apisix.apache.org
+ kind: PluginConfig
+ name: limit-req-plugin-config
+ backendRefs:
+ - name: httpbin-external-domain
+ port: 80
+```
+
+</TabItem>
+
+<TabItem value="apisix-crd">
+
+```yaml title="limit-req-ic.yaml"
+apiVersion: apisix.apache.org/v2
+kind: ApisixUpstream
+metadata:
+ namespace: aic
+ name: httpbin-external-domain
+spec:
+ ingressClassName: apisix
+ externalNodes:
+ - type: Domain
+ name: httpbin.org
+---
+apiVersion: apisix.apache.org/v2
+kind: ApisixRoute
+metadata:
+ namespace: aic
+ name: limit-req-route
+spec:
+ ingressClassName: apisix
+ http:
+ - name: limit-req-route
+ match:
+ paths:
+ - /get
+ methods:
+ - GET
+ upstreams:
+ - name: httpbin-external-domain
+ plugins:
+ - name: limit-req
+ config:
+ rate: 1
+ burst: 1
+ key: remote_addr
+ rejected_code: 429
+ policy: local
+```
+
+</TabItem>
+
+</Tabs>
+
+应用配置：
+
+```shell
+kubectl apply -f limit-req-ic.yaml
+```
+
+</TabItem>
+
+</Tabs>
+
+❶ `burst`：允许 1 个超过 `rate` 的请求延迟处理。
+
生成三个对路由的请求：
```shell
@@ -159,13 +507,24 @@ resp=$(seq 3 | xargs -I{} curl -i "http://127.0.0.1:9080/get" -o /dev/null -s -w
echo "200 responses: $count_200 ; 429 responses: $count_429"
```
-您可能会看到所有三个请求都成功：
+你可能会看到所有三个请求都成功：
```text
200 responses: 3 ; 429 responses: 0
```
-现在，将 `burst` 更新为 0 或将 `nodelay` 设置为 `true`，如下所示：
+要查看没有 `burst` 的效果，请将 `burst` 更新为 0 或将 `nodelay` 设置为 `true`，如下所示：
+
+<Tabs
+groupId="api"
+defaultValue="admin-api"
+values={[
+{label: 'Admin API', value: 'admin-api'},
+{label: 'ADC', value: 'adc'},
+{label: 'Ingress Controller', value: 'aic'}
+]}>
+
+<TabItem value="admin-api">
```shell
curl "http://127.0.0.1:9180/apisix/admin/routes/limit-req-route" -X PATCH \
@@ -179,6 +538,121 @@ curl "http://127.0.0.1:9180/apisix/admin/routes/limit-req-route" -X PATCH \
}'
```
+</TabItem>
+
+<TabItem value="adc">
+
+使用 `nodelay: true` 更新 ADC YAML：
+
+```yaml title="adc.yaml"
+services:
+ - name: httpbin
+ routes:
+ - uris:
+ - /get
+ name: limit-req-route
+ plugins:
+ limit-req:
+ rate: 1
+ burst: 1 # alternatively, set burst to 0
+ key: remote_addr
+ rejected_code: 429
+ policy: local
+ nodelay: true
+ upstream:
+ type: roundrobin
+ nodes:
+ - host: httpbin.org
+ port: 80
+ weight: 1
+```
+
+使用更新的插件设置同步配置：
+
+```shell
+adc sync -f adc.yaml
+```
+
+</TabItem>
+
+<TabItem value="aic">
+
+更新 manifest 文件如下：
+
+<Tabs
+groupId="k8s-api"
+defaultValue="gateway-api"
+values={[
+{label: 'Gateway API', value: 'gateway-api'},
+{label: 'APISIX CRD', value: 'apisix-crd'}
+]}>
+
+<TabItem value="gateway-api">
+
+```yaml title="limit-req-ic.yaml"
+apiVersion: apisix.apache.org/v1alpha1
+kind: PluginConfig
+metadata:
+ namespace: aic
+ name: limit-req-plugin-config
+spec:
+ plugins:
+ - name: limit-req
+ config:
+ rate: 1
+ burst: 1 # alternatively, set burst to 0
+ key: remote_addr
+ rejected_code: 429
+ policy: local
+ nodelay: true
+```
+
+</TabItem>
+
+<TabItem value="apisix-crd">
+
+```yaml title="limit-req-ic.yaml"
+apiVersion: apisix.apache.org/v2
+kind: ApisixRoute
+metadata:
+ namespace: aic
+ name: limit-req-route
+spec:
+ ingressClassName: apisix
+ http:
+ - name: limit-req-route
+ match:
+ paths:
+ - /get
+ methods:
+ - GET
+ upstreams:
+ - name: httpbin-external-domain
+ plugins:
+ - name: limit-req
+ config:
+ rate: 1
+ burst: 1 # alternatively, set burst to 0
+ key: remote_addr
+ rejected_code: 429
+ policy: local
+ nodelay: true
+```
+
+</TabItem>
+
+</Tabs>
+
+应用更新的配置：
+
+```shell
+kubectl apply -f limit-req-ic.yaml
+```
+
+</TabItem>
+
+</Tabs>
+
再次向路由生成三个请求：
```shell
@@ -188,17 +662,28 @@ resp=$(seq 3 | xargs -I{} curl -i "http://127.0.0.1:9080/get" -o /dev/null -s -w
echo "200 responses: $count_200 ; 429 responses: $count_429"
```
-您应该会看到类似以下内容的响应，表明超出速率的请求已被拒绝：
+你应该会看到类似以下内容的响应，表明超出速率的请求已被拒绝：
```text
200 responses: 1 ; 429 responses: 2
```
-### 通过远程地址和消费者名称应用速率限制
+### 按远程地址和消费者名称应用速率限制
以下示例演示了通过变量组合 `remote_addr` 和 `consumer_name` 来限制请求的速率。
-使用 `limit-req` 插件创建一个路由，允许每个远程地址和每个消费者 有 1 QPS。
+使用 `limit-req` 插件创建一个路由，允许每个远程地址和每个消费者有 1 QPS。
+
+<Tabs
+groupId="api"
+defaultValue="admin-api"
+values={[
+{label: 'Admin API', value: 'admin-api'},
+{label: 'ADC', value: 'adc'},
+{label: 'Ingress Controller', value: 'aic'}
+]}>
+
+<TabItem value="admin-api">
创建消费者 `john`：
@@ -250,7 +735,7 @@ curl "http://127.0.0.1:9180/apisix/admin/consumers/jane/credentials" -X PUT \
}'
```
-创建一个带有 `key-auth` 和 `limit-req` 插件的路由，并在 `limit-req` 插件中指定使用变量组合作为速率限制 key：
+创建一个带有 `key-auth` 和 `limit-req` 插件的路由：
```shell
curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
@@ -265,7 +750,8 @@ curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
"burst": 0,
"key": "$remote_addr $consumer_name",
"key_type": "var_combination",
- "rejected_code": 429
+ "rejected_code": 429,
+ "policy": "local"
}
},
"upstream": {
@@ -277,6 +763,244 @@ curl "http://127.0.0.1:9180/apisix/admin/routes" -X PUT \
}'
```
+</TabItem>
+
+<TabItem value="adc">
+
+创建两个消费者以及一个按消费者进行速率限制的路由：
+
+```yaml title="adc.yaml"
+consumers:
+ - username: john
+ credentials:
+ - name: key-auth
+ type: key-auth
+ config:
+ key: john-key
+ - username: jane
+ credentials:
+ - name: key-auth
+ type: key-auth
+ config:
+ key: jane-key
+services:
+ - name: limit-req-service
+ routes:
+ - name: limit-req-route
+ uris:
+ - /get
+ plugins:
+ key-auth: {}
+ limit-req:
+ rate: 1
+ burst: 0
+ key: "$remote_addr $consumer_name"
+ key_type: var_combination
+ rejected_code: 429
+ policy: local
+ upstream:
+ type: roundrobin
+ nodes:
+ - host: httpbin.org
+ port: 80
+ weight: 1
+```
+
+将配置同步到网关：
+
+```shell
+adc sync -f adc.yaml
+```
+
+</TabItem>
+
+<TabItem value="aic">
+
+创建两个消费者以及一个按消费者进行速率限制的路由：
+
+<Tabs
+groupId="k8s-api"
+defaultValue="gateway-api"
+values={[
+{label: 'Gateway API', value: 'gateway-api'},
+{label: 'APISIX CRD', value: 'apisix-crd'}
+]}>
+
+<TabItem value="gateway-api">
+
+```yaml title="limit-req-ic.yaml"
+apiVersion: apisix.apache.org/v1alpha1
+kind: Consumer
+metadata:
+ namespace: aic
+ name: john
+spec:
+ gatewayRef:
+ name: apisix
+ credentials:
+ - type: key-auth
+ name: primary-key
+ config:
+ key: john-key
+---
+apiVersion: apisix.apache.org/v1alpha1
+kind: Consumer
+metadata:
+ namespace: aic
+ name: jane
+spec:
+ gatewayRef:
+ name: apisix
+ credentials:
+ - type: key-auth
+ name: primary-key
+ config:
+ key: jane-key
+---
+apiVersion: v1
+kind: Service
+metadata:
+ namespace: aic
+ name: httpbin-external-domain
+spec:
+ type: ExternalName
+ externalName: httpbin.org
+---
+apiVersion: apisix.apache.org/v1alpha1
+kind: PluginConfig
+metadata:
+ namespace: aic
+ name: limit-req-plugin-config
+spec:
+ plugins:
+ - name: key-auth
+ config:
+ _meta:
+ disable: false
+ - name: limit-req
+ config:
+ rate: 1
+ burst: 0
+ key: "$remote_addr $consumer_name"
+ key_type: var_combination
+ rejected_code: 429
+ policy: local
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+ namespace: aic
+ name: limit-req-route
+spec:
+ parentRefs:
+ - name: apisix
+ rules:
+ - matches:
+ - path:
+ type: Exact
+ value: /get
+ filters:
+ - type: ExtensionRef
+ extensionRef:
+ group: apisix.apache.org
+ kind: PluginConfig
+ name: limit-req-plugin-config
+ backendRefs:
+ - name: httpbin-external-domain
+ port: 80
+```
+
+</TabItem>
+
+<TabItem value="apisix-crd">
+
+```yaml title="limit-req-ic.yaml"
+apiVersion: apisix.apache.org/v2
+kind: ApisixConsumer
+metadata:
+ namespace: aic
+ name: john
+spec:
+ ingressClassName: apisix
+ authParameter:
+ keyAuth:
+ value:
+ key: john-key
+---
+apiVersion: apisix.apache.org/v2
+kind: ApisixConsumer
+metadata:
+ namespace: aic
+ name: jane
+spec:
+ ingressClassName: apisix
+ authParameter:
+ keyAuth:
+ value:
+ key: jane-key
+---
+apiVersion: apisix.apache.org/v2
+kind: ApisixUpstream
+metadata:
+ namespace: aic
+ name: httpbin-external-domain
+spec:
+ ingressClassName: apisix
+ externalNodes:
+ - type: Domain
+ name: httpbin.org
+---
+apiVersion: apisix.apache.org/v2
+kind: ApisixRoute
+metadata:
+ namespace: aic
+ name: limit-req-route
+spec:
+ ingressClassName: apisix
+ http:
+ - name: limit-req-route
+ match:
+ paths:
+ - /get
+ methods:
+ - GET
+ upstreams:
+ - name: httpbin-external-domain
+ plugins:
+ - name: key-auth
+ config:
+ _meta:
+ disable: false
+ - name: limit-req
+ config:
+ rate: 1
+ burst: 0
+ key: "$remote_addr $consumer_name"
+ key_type: var_combination
+ rejected_code: 429
+ policy: local
+```
+
+</TabItem>
+
+</Tabs>
+
+应用配置：
+
+```shell
+kubectl apply -f limit-req-ic.yaml
+```
+
+</TabItem>
+
+</Tabs>
+
+❶ `key-auth`：在路由上启用 key 认证。
+
+❷ `key`：设置为 `$remote_addr $consumer_name`，以按远程地址和消费者应用速率限制配额。
+
+❸ `key_type`：设置为 `var_combination`，以将 `key` 解释为变量的组合。
+
同时发送两个请求，每个请求针对一个消费者：
```shell
@@ -284,8 +1008,8 @@ curl -i "http://127.0.0.1:9080/get" -H 'apikey: jane-key' & \
curl -i "http://127.0.0.1:9080/get" -H 'apikey: john-key' &
```
-您应该会收到两个请求的 `HTTP/1.1 200 OK`，表明请求未超过每个消费者的阈值。
+你应该会收到两个请求的 `HTTP/1.1 200 OK`，表明请求未超过每个消费者的阈值。
-如果您在同一秒内以任一消费者身份发送更多请求，应该会收到 `HTTP/1.1 429 Too Many Requests` 响应。
+如果你在同一秒内以任一消费者身份发送更多请求，应该会收到 `HTTP/1.1 429 Too Many Requests` 响应。
-这验证了插件速率限制是通过变量 `remote_addr` 和 `consumer_name` 的来实现的。
+这验证了插件通过变量组合 `remote_addr` 和 `consumer_name` 进行速率限制。