Ratelimiting or Circuit breaking based on L7 rules

[kprakasam]

Title: Ratelimiting or Circuit breaking based on L7 rules

Description:
Envoy currently allows only one circuit breaker per upstream cluster and a global rate limiter service, this is very constraining when dealing with DDOS attacks when there is only one upstream cluster (If you want to understand the specific use case we can discuss offline). We are wondering if we can create a filter that can configure one or more localized rate limiter/circuit-breaker (https://github.com/Netflix/concurrency-limits) associated with an arbitrary L7 rule and when the breaker is trigger allow arbitrary action to be takes (ex: Serve a static page, cached version of page, etc.). I would like to hear the community's thoughts on this approach.

Sample Filter Configuration

  rate-limiters:
    ingressRoute: mweb-1-80
    www.acme.com :
    - name: view-item
      match:
        - header: { name: "path", regex_match: "/itm/.*" }
      circuit-breakers:
         - windowed:
        ...
       - fixed: 
        ...
      action:
          drop: true
   - name: default
     circuit-breakers:
       - gradient2:
        ...
       - aimd
        ...
     action:
       monitor: true

[mattklein123]

See #7918. I would like to see this happen in the context of a dedicated WAF filter which can perform various actions that are configured on a per-route basis. cc @gkleiman who can provide more color and I have discussed this with also.

[kprakasam]

@mattklein123, I and my team member did have a meeting with @gkleiman around the holidays and we have forked the RBAC to implement the our WAF and rolled out the OFAC functionality few weeks back in our clusters. I thought circuit breaker could be built as a standalone isolated feature since WAF could evolve in to much larger in scope. Anyway I'd be happy to setup a meeting with Gaston to discuss further.

[stale]

This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in the next 7 days unless it is tagged "help wanted" or other activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically closed because it has not had activity in the last 37 days. If this issue is still valid, please ping a maintainer and ask them to label it as "help wanted". Thank you for your contributions.