Rate limit

This extension may be referenced by the qualified name envoy.filters.thrift.ratelimit


This extension is functional but has not had substantial production burn time, use only with this caveat.

This extension is not hardened and should only be used in deployments where both the downstream and upstream are trusted.

Rate limit configuration overview.


[extensions.filters.network.thrift_proxy.filters.ratelimit.v3.RateLimit proto]

  "domain": "...",
  "stage": "...",
  "timeout": "{...}",
  "failure_mode_deny": "...",
  "rate_limit_service": "{...}"

(string, REQUIRED) The rate limit domain to use in the rate limit service request.


(uint32) Specifies the rate limit configuration stage. Each configured rate limit filter performs a rate limit check using descriptors configured in the extensions.filters.network.thrift_proxy.v3.RouteAction for the request. Only those entries with a matching stage number are used for a given filter. If not set, the default stage number is 0.


The filter supports a range of 0 - 10 inclusively for stage numbers.


(Duration) The timeout in milliseconds for the rate limit service RPC. If not set, this defaults to 20ms.


(bool) The filter’s behaviour in case the rate limiting service does not respond back. When it is set to true, Envoy will not allow traffic in case of communication failure between rate limiting service and the proxy. Defaults to false.


(config.ratelimit.v3.RateLimitServiceConfig, REQUIRED) Configuration for an external rate limit service provider. If not specified, any calls to the rate limit service will immediately return success.