Bandwidth share

Bandwidth limiting architecture overview
This filter should be configured with the type URL type.googleapis.com/envoy.extensions.filters.http.bandwidth_share.v3.BandwidthShare.
v3 API reference

The HTTP Bandwidth share filter limits the size of data flow to the max bandwidth set in request_limit.kbps or response_limit.kbps when the request’s route, virtual host or filter chain has a bandwidth share configuration.

If the bandwidth limit has been exhausted the filter stops further transfer until more bandwidth gets allocated according to the fill_interval (default is 50 milliseconds). If the connection buffer fills up with accumulated data then the source of data will have readDisable(true) set as described in the flow control doc.

When actively being limited, the filter splits the available bandwidth between active tenants by weight, and between parallel requests for a single tenant evenly. For example, with six active requests divided among three tenants:

Tenant	Weight	Share to tenant	Share to request
foo	1	20%	6.6̅%
bar	3	60%	30%
foo	1	20%	6.6̅%
foo	1	20%	6.6̅%
bar	3	60%	30%
baz	1	20%	20%

Note

The token bucket is shared across all workers, thus the limits are applied per Envoy process.

Example configuration

Example filter configuration for a globally enabled bandwidth share but disabled for a specific route:

bandwidth-share-filter.yaml

          "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
          codec_type: AUTO
          stat_prefix: ingress_http
          route_config:
            name: local_route
            virtual_hosts:
            - name: local_service
              domains: ["*"]
              routes:
              - match: {prefix: "/path/with/bandwidth/share"}
                route: {cluster: service_protected_by_bandwidth_share}
                typed_per_filter_config:
                  envoy.filters.http.bandwidth_share:
                    "@type": type.googleapis.com/envoy.extensions.filters.http.bandwidth_share.v3.BandwidthShare
                    request_limit:
                      bucket_id: foo
                      kbps:
                        default_value: 10000
                        runtime_key: bandwidth_share_limit_foo
                    fill_interval: 0.1s
                    tenant_name_selector:
                      on_no_match:
                        action:
                          name: use_client_certificate_name_as_tenant_name
                          typed_config:
                            "@type": type.googleapis.com/envoy.config.core.v3.SubstitutionFormatString
                            omit_empty_values: true
                            text_format_source:
                              inline_string: '%CEL(re.extract(connection.subject_peer_certificate, R"CN=([^,]*)", "\\1"))%'
                            formatters:
                            - name: envoy.formatter.cel
                              typed_config:
                                "@type": type.googleapis.com/envoy.extensions.formatter.cel.v3.Cel
              - match: {prefix: "/"}
                route: {cluster: web_service}
          http_filters:
          - name: envoy.filters.http.bandwidth_share
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.bandwidth_share.v3.BandwidthShare
          - name: envoy.filters.http.router
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
  clusters:

Statistics

The HTTP bandwidth share filter outputs statistics in the <stat_prefix>.bandwidth_share. namespace.

All metrics are emitted with the following tags:

bucket_id (may be empty-string, as configured in request_limit or response_limit)
tenant (if not explicitly configured for inclusion with include_stats_tag in tenant_config, will be empty-string)
direction (request or response)

The counter bytes is additionally emitted with the following tag:

handling (limited or not_limited - not_limited is used for bytes for which the limiter remained in “fast” mode as the configured limit had not been approached.)

Name	Type	Description
bytes	Counter	Number of bytes for which the bandwidth share filter was consulted.
streams_currently_limited	Gauge	Number of streams that are currently experiencing delays.
bytes_pending	Gauge	Number of bytes that are currently buffered due to delays.