Какие параметры отвечают за rateLimit в Ingress kuberneties?

Question

[blabs]

Возникает ошибка 429 "too many requests" при отправке запроса с фронта на сервер. Проверили настройки в ingress на NETWORK LOAD BALANCER, там установлены хорошие лимиты с большим запасом. С чем может быть связана проблема и как ее можно решить?

прикладываю инструкцию по настройке ingress, которую мы использовали для сборка configMap
https://cloudstreamgate.com/response/show_text/1c0...

пример ошибки

Response Headers

access-control-allow-credentials: true
access-control-allow-headers: h-rcs,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization,X-Account-Token
access-control-allow-methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1728000
content-length: 60
content-type: text/plain
date: Tue, 19 Nov 2024 19:56:17 GMT

The number of connections from your ip exceeds MaxConnsPerIP

Comments

[Alexey Dmitriev]

1. что за NLB и где размещен?
2. Что в качестве ingress controller?
3. что такое сервер, к которому идут запросы с фронта?
4. Что собой представляет ваш кластер кубера?

Answer 1

[Kirils Curilovs]

параметры отвечают за rateLimit в Ingress kuberneties
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: whoami
annotations:
nginx.ingress.kubernetes.io/limit-rps: "10"
spec:
rules:
- host:
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: whoami
port:
number: 80
ingressClassName: nginx

В этой версии манифеста Ingress мы вводим аннотацию `limit-rps`, которая позволяет нам контролировать количество запросов, принимаемых с заданного IP-адреса каждую секунду.
Список всех аннотации nginx https://github.com/kubernetes/ingress-nginx/blob/m...

Comments

[blabs]

не помогло, ниже описал проблему

Answer 2

[blabs]

Текущая конфигурация все равно не работает, с чем это может быть связано?

ConfigMap для Ingress

apiVersion: v1
data:
  allow-snippet-annotations: "false"
  enable-real-ip: "true"
  http-snippet: limit_req_zone $http_x_forwarded_for zone=perip:1m rate=10000r/s;
    limit_req_zone $http_authorization zone=http_authorization:1m rate=50000r/s;
  limit-req: |
    zone=perip burst=5000 nodelay;
    zone=http_authorization burst=5000 nodelay;
  limit-req-status-code: "429"
  limit-req-zone-settings: |
    $http_x_forwarded_for zone=perip:10m rate=10000r/s;
    $http_authorization zone=http_authorization:10m rate=50000r/s;
  log-format-escape-json: "true"
  log-format-upstream: '{ "remote_addr": "$remote_addr", "remote_port": "$remote_port",
    "remote_user": "$remote_user","time_local": "$time_local","msec": "$msec","vhost":
    "$host","request": "$request","status": "$status","body_bytes_sent": "$body_bytes_sent","http_referer":
    "$http_referer","http_user_agent": "$http_user_agent","http_x_forwarded_for":
    "$http_x_forwarded_for","request_time": "$request_time","upstream_cache_status":
    "$upstream_cache_status","upstream_status": "$upstream_status","upstream_addr":
    "$upstream_addr","upstream_response_time": "$upstream_response_time","uid_set":
    "$uid_set","uid_got": "$uid_got","http_cookie": "$http_cookie","connection": "$connection","connection_requests":
    "$connection_requests","scheme": "content_length": "$content_length", "request_length":
    "$request_length", "request_id": "$request_id" }'
  proxy-real-ip-cidr: 51.250.10.162/32
  use-forwarded-headers: "true"
  use-proxy-protocol: "false"
kind: ConfigMap
metadata:
  annotations:
    meta.helm.sh/release-name: ingress-nginx
    meta.helm.sh/release-namespace: ingress-nginx
  creationTimestamp: "2022-07-26T21:15:21Z"
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: ingress-nginx
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.3.0
    helm.sh/chart: ingress-nginx-4.2.0
  managedFields:
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:data: {}
      f:metadata:
        f:annotations:
          .: {}
          f:meta.helm.sh/release-name: {}
          f:meta.helm.sh/release-namespace: {}
        f:labels:
          .: {}
          f:app.kubernetes.io/component: {}
          f:app.kubernetes.io/instance: {}
          f:app.kubernetes.io/managed-by: {}
          f:app.kubernetes.io/name: {}
          f:app.kubernetes.io/part-of: {}
          f:app.kubernetes.io/version: {}
          f:helm.sh/chart: {}
    manager: helm
    operation: Update
    time: "2022-07-26T21:15:21Z"
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:data:
        f:log-format-escape-json: {}
        f:log-format-upstream: {}
    manager: node-fetch
    operation: Update
    time: "2022-08-28T20:08:48Z"
  - apiVersion: v1
    fieldsType: FieldsV1
    fieldsV1:
      f:data:
        f:allow-snippet-annotations: {}
        f:enable-real-ip: {}
        f:http-snippet: {}
        f:limit-req: {}
        f:limit-req-status-code: {}
        f:limit-req-zone-settings: {}
        f:proxy-real-ip-cidr: {}
        f:use-forwarded-headers: {}
        f:use-proxy-protocol: {}
    manager: yc-console
    operation: Update
    time: "2024-11-19T20:16:55Z"
  name: ingress-nginx-controller
  namespace: ingress-nginx
  resourceVersion: "467993593"
  uid: 0d282050-73f6-431a-8843-2e4128ce3b65

Comments

[Kirils Curilovs]

Вам надо не configmap настраивать
А секцию annotations:
в самом ingress-nginx-controller
пример ниже

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: {{ include "fullname" . }}-ingress
labels:
app.kubernetes.io/name: {{ include "name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/version: "{{ .Release.Revision }}"
app.kubernetes.io/managed-by: {{ .Release.Service }}
helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
annotations:
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
nginx.ingress.kubernetes.io/limit-rpm: "{{ .Values.ingress.requestsPerMinute }}"
nginx.ingress.kubernetes.io/limit-rps: "{{ .Values.ingress.requestsPerSecond }}"
nginx.ingress.kubernetes.io/configuration-snippet: |
limit_req_status 429;
spec:
ingressClassName: "nginx-public"
rules:
- host: {{ .Values.ingress.host }}
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: {{ include "fullname" . }}-service
port:
name: http
# kubectl efdit ingress-nginx-controller --namespace ingress-nginx