solo.io Istio Service Mesh, 24 Aug 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Rate Limiting in Istio with the Developer Portal

Description

Rate Limiting is not a feature currently available in Istio Service Mesh. The Developer Portal for Istio by Solo.io provides the ability to catalog and expose running APIs in an Istio cluster and provides the ability to rate limit services.

Try the Tutorial https://solo.io/blog/tutorial-rate-limiting-of-service-requests-in-istio-service-mesh
Request a Trial https://lp.solo.io/lp-request-a-trial-general
Learn More https://www.solo.io/products/istio-developer-portal/
Question? https://slack.solo.io

A

Hello, my name is jim barton and I'm a field engineer with solo.io in this short video I'll, walk you through a tutorial of how to configure and test rate limiting of services using the istio developer portal from solo.io so rate limiting with istio. Why is that something we're interested in? Well often, policies like rate limiting and external authorization are applied via gateways at the edge of an application network.

A

Many solo customers do that through a open source product we produce called glue, but perhaps you don't have an edge gateway, but you do have an investment in in a service mesh like istio and you'd like to explore the possibility of using that uh istio gateway to enforce policies, like rate limiting. So let's show you how you can do that using the developer portal product from solo, so here's the main documentation page.

A

So for the starting point of this short tutorial, we've already gone through the the setup exercises to set up the application, we're going to be testing. It's a simple pet store application to install istio to install the developer portal itself.

A

We've also gone through these uh through these getting started guides here, uh just these first two parts to actually create the api product um from the from the pet store, uh swagger, spec, and um and also a portal uh to publish out that api product that we created uh what we don't have, yet we don't have any rate limiting policies that we've defined and we don't have any users provisioned to uh to consume those policies.

A

So, in fact, if we switch over here to uh to our terminal window, you can see what we have installed so far, so here's the pet store application itself. Here's the admin server that comes with the dev portal we'll be using that to configure our policy shortly.

A

um Here's the actual core dev portal component and then a couple of external services that can be delegated to from the gateway one is for external off and then one is the rate limiting service that we're going to be exercising here, uh along with its backing redis store. You can also see the standard, istio ingress gateway component, which we'll be injecting this rate limiting policy into okay. So right now we we don't have any policies applied.

A

We don't have any users provision, so this thing is just wide open for anonymous access, so we can go in here and, for example, we can curl this end point you can see we get back a a dog and a cat from our from our pets endpoint, and we can hit this as much as we want with no restrictions.

A

Okay. So if we want to configure rate limiting policy, how would we go about doing that? So, let's switch over here to the uh to the developer portal. So this is the this. Is the admin server. So this is how an administrator for your organization might um might provision these policies and uh and then also users to apply them to so at this point. Well, we have an api defined, as we talked about it's uh contained here in this pet store product you can see here.

A

The uh here are the endpoints that we're exposing, but at this point we don't have any usage plans or rate limiting policies defined. We also don't have any users declared. So let's just quickly go through that process, we will go, create a user very quickly.

A

And after we have that user, we won't bother with setting up any groups for this exercise. We will allocate this user to the pet store product and also to the portal that exposes that product and we will create that user here.

A

So now we have a user defined. Let's go back to our api and create a usage plan that we can use to control access to it. So if we go into plan tab here, we create a plan.

A

We will give it a name we'll also be using uh api keys as the as the off mechanism for this, and let's just provide a basic rate limit of let's say three requests per minute will be the max so we'll create that rate limiting plan, and once we've done, that we can go back to our user and actually bind that usage plan to our user.

A

All right. So, let's see what we have here.

A

If we go back to our.

A

We go back to our terminal here. Here is the api product object and if we dig into this now we'll see that there have been some changes, so you can see now we have a plan associated with this object. That plan includes an off policy with an api key.

A

It also includes a rate limit of three per minute and you can also tell that uh that it's been successfully applied. So what we would expect to happen now is if we go and we try to just do an anonymous execution of that endpoint, it's probably going to fail, and indeed it does fail with a 401 unauthorized code as we expect.

A

So um what we'd like to do now is change hats, and so we're going to change hats from we're going to change from our administrator hat into our developer hat and so in our developer hat we're going to go to the to the portal interface and we will log in as the new user that's been.

A

Created and we will supply a new password.

A

And once we've done that we can view the apis that have been provisioned for our users. So here's the pet store product here are the four endpoints that have been that have been allocated to us and if we try to go in and let's say, execute this api pets endpoint initially before we've allocated uh an api key and applied that it's going to fail. Just like you would expect.

A

um But we now have the ability to go in and build an api key for our user.

A

And so once we provision that we can copy it and actually go back to the api and and now test this out. So um let's authorize using the key first.

A

And now, if we try to execute this same operation, you can see here's the actual curl command. That was that was generated, and you can see that it now succeeds with the 200 code and it gives us back our our dog and our cat. Okay. So right limiting does that work? um Let's switch back over to our terminal here, and so, if we execute this uh a first time, it's going to succeed, just as we would expect.

A

Let's add some verbosity here to our curl response, and we do it a third time in the same minute and it's going to work just as we expect, but once we exceed that threshold, I guess we must have crossed a minute boundary there. Once we exceed that threshold of three per minute, you can see that now we get a 429 error too many requests. So so what we've done here is we have specified a rate limiting policy external to the application itself.

A

uh We have applied it through uh through an envoy filter via the istio ingress gateway and uh have done all of that without um without provisioning, an external api gateway service.

A

So um I hope you found this little tutorial helpful if you'd like to dig deeper on the istio developer portal, I recommend this this article in the solo.I o blog. You can also stop by our youtube channel for more information or join our slack channel as well.