Rate Limiting Advanced Configuration

You are browsing documentation for an outdated plugin version.

Configuration

This plugin is partially compatible with DB-less mode.

The cluster strategy is not supported in DB-less and hybrid modes. For Kong Gateway in DB-less or hybrid mode, the redis strategy is the only available option to configure the plugin with a central data store.

Note: We recommend setting namespace to a static value in DB-less mode. The namespace will be regenerated on every configuration change if not explicitly set, resetting counters to zero.

Compatible protocols

The Rate Limiting Advanced plugin is compatible with the following protocols:

grpc, grpcs, http, https

Parameters

Here's a list of all the parameters which can be used in this plugin's configuration:

• name or plugin

  string required

  The name of the plugin, in this case rate-limiting-advanced.

  • If using the Kong Admin API, Konnect API, declarative configuration, or decK files, the field is name.
  • If using the KongPlugin object in Kubernetes, the field is plugin.

• instance_name

  string

  An optional custom name to identify an instance of the plugin, for example rate-limiting-advanced_my-service.

  The instance name shows up in Kong Manager and in Konnect, so it's useful when running the same plugin in multiple contexts, for example, on multiple services. You can also use it to access a specific plugin instance via the Kong Admin API.

  An instance name must be unique within the following context:

  • Within a workspace for Kong Gateway Enterprise
  • Within a control plane or control plane group for Konnect
  • Globally for Kong Gateway (OSS)

• service.name or service.id

  string

  The name or ID of the service the plugin targets. Set one of these parameters if adding the plugin to a service through the top-level /plugins endpoint. Not required if using /services/{serviceName|Id}/plugins.

• route.name or route.id

  string

  The name or ID of the route the plugin targets. Set one of these parameters if adding the plugin to a route through the top-level /plugins endpoint. Not required if using /routes/{routeName|Id}/plugins.

• consumer.name or consumer.id

  string

  The name or ID of the consumer the plugin targets. Set one of these parameters if adding the plugin to a consumer through the top-level /plugins endpoint. Not required if using /consumers/{consumerName|Id}/plugins.

• enabled

  boolean default: true

  Whether this plugin will be applied.

• config

  record required
  • identifier

    string required default: consumer Must be one of: ip, credential, consumer, service, header, path

    The type of identifier used to generate the rate limit key. Defines the scope used to increment the rate limiting counters. Can be ip, credential, consumer, service, header, or path.

  • window_size

    array of type number required

    One or more window sizes to apply a limit to (defined in seconds). There must be a matching number of window limits and sizes specified.

  • window_type

    string default: sliding Must be one of: fixed, sliding

    Sets the time window type to either sliding (default) or fixed. Sliding windows apply the rate limiting logic while taking into account previous hit rates (from the window that immediately precedes the current) using a dynamic weight. Fixed windows consist of buckets that are statically assigned to a definitive time range, each request is mapped to only one fixed window based on its timestamp and will affect only that window’s counters. For more information refer to the Enterprise Rate Limiting Library Overview.

  • limit

    array of type number required

    One or more requests-per-window limits to apply. There must be a matching number of window limits and sizes specified.

  • sync_rate

    number

    How often to sync counter data to the central data store. A value of 0 results in synchronous behavior; a value of -1 ignores sync behavior entirely and only stores counters in node memory. A value greater than 0 will sync the counters in the specified number of seconds. The minimum allowed interval is 0.02 seconds (20ms).

  • namespace

    string required

    The rate limiting library namespace to use for this plugin instance. Counter data and sync configuration is isolated in each namespace. This value should be unique between every instance of a plugin in most configurations.

    If you use the same namespace value for multiple instances of the plugin, the rate limit will be shared between all instances. For example, if you set namespace: helloworld when adding the rate limiting plugin to service-a and use the same namespace on service-b, a request to either service will increment the counter for the caller. This allows you to share rate limits between services.

    Important: If managing Kong Gateway with declarative configuration or running Kong Gateway in DB-less mode, set the namespace explicitly in your declarative configuration.
    
    If not set, you will run into the following issues:

    • In DB-less mode, this field will be regenerated automatically on every configuration change.
    • If applying declarative configuration with decK, decK will automatically fail the update and require a namespace value.

  • strategy

    string required default: local Must be one of: cluster, redis, local

    The rate-limiting strategy to use for retrieving and incrementing the limits. Available values are:

    • local: Counters are stored locally in-memory on the node (same effect as setting sync_rate to -1).
    • cluster: Counters are stored in the Kong datastore and shared across the nodes.
    • redis: Counters are stored on a Redis server and shared across the nodes.

    In DB-less, hybrid mode, and Konnect, the cluster config strategy is not supported.

    From 3.0.0.0 onwards, Kong disallows the plugin enablement if the strategy is cluster and sync_rate is -1 with DB-less or hybrid mode. From 3.2.0.0 onward, please use a different strategy or set sync_rate to -1. For details on which strategy should be used, refer to the implementation considerations.

  • dictionary_name

    string required default: kong_rate_limiting_counters

    The shared dictionary where counters are stored. When the plugin is configured to synchronize counter data externally (that is config.strategy is cluster or redis and config.sync_rate isn’t -1), this dictionary serves as a buffer to populate counters in the data store on each synchronization cycle.

  • hide_client_headers

    boolean default: false

    Optionally hide informative response headers that would otherwise provide information about the current status of limits and counters as described in the paragraph Headers sent to the client. Available options: true or false.

  • retry_after_jitter_max

    number default: 0

    The upper bound of a jitter (random delay) in seconds to be added to the Retry-After header of denied requests (status = 429) in order to prevent all the clients from coming back at the same time. The lower bound of the jitter is 0; in this case, the Retry-After header is equal to the RateLimit-Reset header.

  • header_name

    string

    Header name to use as the rate limit key when config.identifier is configured with the value header. Ignored when config.identifier is not header.

  • path

    string starts_with: /

    Request path to use as the rate limit key when config.identifier is configured with the value path. Ignored when config.identifier has any other value.

  • redis

    record required
    • host

      string

      Host to use for Redis connection when the redis strategy is defined. This parameter accepts a hostname or an IP address as a value.

    • port

      integer between: 0 65535

      Specifies the Redis server port when using the redis strategy. Must be a value between 0 and 65535. Default: 6379.

    • timeout

      integer default: 2000 between: 0 2147483646

      Connection timeout (in milliseconds) to use for Redis connection when the redis strategy is defined. This field is deprecated and replaced with redis.connect_timeout, redis.send_timeout, and redis.read_timeout. The redis.timeout field will continue to work in a backwards compatible way, but it is recommended to use the replacement fields. If set to something other than the default, a deprecation warning will be logged in the log file, stating the field’s deprecation and planned removal in v3.x.x.

    • connect_timeout

      integer between: 0 2147483646

      Connection timeout to use for Redis connection when the redis strategy is defined.

    • send_timeout

      integer between: 0 2147483646

      Send timeout to use for Redis connection when the redis strategy is defined.

    • read_timeout

      integer between: 0 2147483646

      Read timeout to use for Redis connection when the redis strategy is defined.

    • username

      string referenceable

      Username to use for Redis connection when the redis strategy is defined and ACL authentication is desired. If undefined, ACL authentication will not be performed.

      This requires Redis v6.0.0+. The username cannot be set to default.

    • password

      string referenceable encrypted

      Password to use for Redis connection when the redis strategy is defined. If undefined, no AUTH commands are sent to Redis.

    • sentinel_username

      string referenceable

      Sentinel username to authenticate with a Redis Sentinel instance. If undefined, ACL authentication will not be performed. This requires Redis v6.2.0+.

    • sentinel_password

      string referenceable encrypted

      Sentinel password to authenticate with a Redis Sentinel instance. If undefined, no AUTH commands are sent to Redis Sentinels.

    • database

      integer default: 0

      Database to use for Redis connection when the redis strategy is defined.

    • keepalive_pool_size

      integer default: 30 between: 1 2147483646

      The size limit for every cosocket connection pool associated with every remote server, per worker process. If no keepalive_pool_size is specified and no keepalive_backlog is specified, no pool is created. If no keepalive_pool_size is specified and keepalive_backlog is specified, then the pool uses the default value 30.

    • keepalive_backlog

      integer between: 0 2147483646

      If specified, limits the total number of opened connections for a pool. If the connection pool is full, all connection queues beyond the maximum limit go into the backlog queue. Once the backlog queue is full, subsequent connect operations will fail and return nil. Queued connect operations resume once the number of connections in the pool is less than keepalive_pool_size. Note that queued connect operations are subject to set timeouts.

    • sentinel_master

      string

      Sentinel master to use for Redis connections when the redis strategy is defined. Defining this value implies using Redis Sentinel.

    • sentinel_role

      string Must be one of: master, slave, any

      Sentinel role to use for Redis connections when the redis strategy is defined. Defining this value implies using Redis Sentinel. Available options: master, slave, any.

    • sentinel_addresses

      array of type string len_min: 1

      Sentinel addresses to use for Redis connections when the redis strategy is defined. Defining this value implies using Redis Sentinel. Each string element must consist of a hostname (or IP address) and port. The minimum length of the array is 1 element.

    • cluster_addresses

      array of type string len_min: 1

      Cluster addresses to use for Redis connections when the redis strategy is defined. Defining this value implies using Redis cluster. Each string element must consist of a hostname (or IP address) and port. The minimum length of the array is 1 element.

    • ssl

      boolean default: false

      If set to true, then uses SSL to connect to Redis.

    • ssl_verify

      boolean default: false

      If set to true, then verifies the validity of the server SSL certificate. Note that you need to configure the lua_ssl_trusted_certificate to specify the CA (or server) certificate used by your redis server. You may also need to configure lua_ssl_verify_depth accordingly.

    • server_name

      string

      Specifies the server name for the new TLS extension Server Name Indication (SNI) when connecting over SSL.

  • enforce_consumer_groups

    boolean default: false

    Set to true to enable consumer_groups, which allows the settings from one of the allowed consumer groups to override the given plugin configuration.

  • consumer_groups

    array of type string

    List of consumer groups allowed to override the rate limiting settings for the given Route or Service. Required if enforce_consumer_groups is set to true. Flipping enforce_consumer_groups from true to false disables the group override, but does not clear the list of consumer groups. You can then flip enforce_consumer_groups to true to re-enforce the groups.

  • disable_penalty

    boolean default: false

    If set to true, this doesn’t count denied requests (status = 429). If set to false, all requests, including denied ones, are counted. This parameter only affects the sliding window_type.

  • error_code

    number default: 429

    Set a custom error code to return when the rate limit is exceeded.

  • error_message

    string default: API rate limit exceeded

    Set a custom error message to return when the rate limit is exceeded.