Response Rate Limiting Configuration

Configuration

This plugin is partially compatible with DB-less mode.

The plugin will run fine with the local policy (which doesn’t use the database) or the redis policy (which uses an independent Redis, so it is compatible with DB-less).

The plugin will not work with the cluster policy, which requires writes to the database.

Compatible protocols

The Response Rate Limiting plugin is compatible with the following protocols:

grpc, grpcs, http, https

Parameters

Here's a list of all the parameters which can be used in this plugin's configuration:

• name or plugin

  string required

  The name of the plugin, in this case response-ratelimiting.

  • If using the Kong Admin API, Konnect API, declarative configuration, or decK files, the field is name.
  • If using the KongPlugin object in Kubernetes, the field is plugin.

• instance_name

  string

  An optional custom name to identify an instance of the plugin, for example response-ratelimiting_my-service.

  The instance name shows up in Kong Manager and in Konnect, so it's useful when running the same plugin in multiple contexts, for example, on multiple services. You can also use it to access a specific plugin instance via the Kong Admin API.

  An instance name must be unique within the following context:

  • Within a workspace for Kong Gateway Enterprise
  • Within a control plane or control plane group for Konnect
  • Globally for Kong Gateway (OSS)

• service.name or service.id

  string

  The name or ID of the service the plugin targets. Set one of these parameters if adding the plugin to a service through the top-level /plugins endpoint. Not required if using /services/{serviceName|Id}/plugins.

• route.name or route.id

  string

  The name or ID of the route the plugin targets. Set one of these parameters if adding the plugin to a route through the top-level /plugins endpoint. Not required if using /routes/{routeName|Id}/plugins.

• consumer.name or consumer.id

  string

  The name or ID of the consumer the plugin targets. Set one of these parameters if adding the plugin to a consumer through the top-level /plugins endpoint. Not required if using /consumers/{consumerName|Id}/plugins.

• enabled

  boolean default: true

  Whether this plugin will be applied.

• config

  record required
  • header_name

    string default: x-kong-limit

    The name of the response header used to increment the counters.

  • limit_by

    string default: consumer Must be one of: consumer, credential, ip

    The entity that will be used when aggregating the limits: consumer, credential, ip. If the consumer or the credential cannot be determined, the system will always fallback to ip.

  • policy

    string default: local Must be one of: local, cluster, redis

    The rate-limiting policies to use for retrieving and incrementing the limits.

  • fault_tolerant

    boolean required default: true

    A boolean value that determines if the requests should be proxied even if Kong has troubles connecting a third-party datastore. If true, requests will be proxied anyway, effectively disabling the rate-limiting function until the datastore is working again. If false, then the clients will see 500 errors.

  • redis

    record required

    Redis configuration

    • host

      string

      A string representing a host name, such as example.com.

    • port

      integer default: 6379 between: 0 65535

      An integer representing a port number between 0 and 65535, inclusive.

    • timeout

      integer default: 2000 between: 0 2147483646

      An integer representing a timeout in milliseconds. Must be between 0 and 2^31-2.

    • username

      string referenceable

      Username to use for Redis connections. If undefined, ACL authentication won’t be performed. This requires Redis v6.0.0+. To be compatible with Redis v5.x.y, you can set it to default.

    • password

      string referenceable encrypted len_min: 0

      Password to use for Redis connections. If undefined, no AUTH commands are sent to Redis.

    • database

      integer default: 0

      Database to use for the Redis connection when using the redis strategy

    • ssl

      boolean default: false

      If set to true, uses SSL to connect to Redis.

    • ssl_verify

      boolean default: false

      If set to true, verifies the validity of the server SSL certificate. If setting this parameter, also configure lua_ssl_trusted_certificate in kong.conf to specify the CA (or server) certificate used by your Redis server. You may also need to configure lua_ssl_verify_depth accordingly.

    • server_name

      string

      A string representing an SNI (server name indication) value for TLS.

  • block_on_first_violation

    boolean required default: false

    A boolean value that determines if the requests should be blocked as soon as one limit is being exceeded. This will block requests that are supposed to consume other limits too.

  • hide_client_headers

    boolean required default: false

    Optionally hide informative response headers.

  • limits

    map required len_min: 1

    A map that defines rate limits for the plugin.

• redis_host

  string
  Deprecation notice: response-ratelimiting: config.redis_host is deprecated, please use config.redis.host instead. This field is planned to be removed in version 4.0.

• redis_port

  integer
  Deprecation notice: response-ratelimiting: config.redis_port is deprecated, please use config.redis.port instead. This field is planned to be removed in version 4.0.

• redis_password

  string len_min: 0
  Deprecation notice: response-ratelimiting: config.redis_password is deprecated, please use config.redis.password instead. This field is planned to be removed in version 4.0.

• redis_username

  string
  Deprecation notice: response-ratelimiting: config.redis_username is deprecated, please use config.redis.username instead. This field is planned to be removed in version 4.0.

• redis_ssl

  boolean
  Deprecation notice: response-ratelimiting: config.redis_ssl is deprecated, please use config.redis.ssl instead. This field is planned to be removed in version 4.0.

• redis_ssl_verify

  boolean
  Deprecation notice: response-ratelimiting: config.redis_ssl_verify is deprecated, please use config.redis.ssl_verify instead. This field is planned to be removed in version 4.0.

• redis_server_name

  string
  Deprecation notice: response-ratelimiting: config.redis_server_name is deprecated, please use config.redis.server_name instead. This field is planned to be removed in version 4.0.

• redis_timeout

  integer
  Deprecation notice: response-ratelimiting: config.redis_timeout is deprecated, please use config.redis.timeout instead. This field is planned to be removed in version 4.0.

• redis_database

  integer
  Deprecation notice: response-ratelimiting: config.redis_database is deprecated, please use config.redis.database instead. This field is planned to be removed in version 4.0.