Challenge ·Medium

Rate-Limit a Route with a Kong Plugin

Alejandro Mercado
by  Alejandro Mercado · on
Kubernetes
Kong is already installed and routing a workload. Turn it from a plain ingress controller into an API gateway: attach a rate-limiting plugin to the route so the gateway rejects requests over the limit with HTTP 429.
#Rancher#Kong#api-gateway#plugins

Kong is already installed on this cluster, and a web workload in the demo namespace is routed through it - a request to the Kong gateway on http://172.16.0.2:30081/ returns HTTP 200. Right now Kong is just forwarding traffic, no different from any ingress controller.

Your job is to make it behave like an API gateway: attach a rate-limiting plugin to the route so that once a client exceeds the limit, the gateway rejects further requests with HTTP 429 Too Many Requests - before they ever reach the workload. You work from the dev-machine terminal.

Rate-Limit the Route

Create a rate-limiting Kong plugin and attach it to the web Ingress. Pick a small per-minute limit so the effect is easy to see. When it works, a burst of requests to the gateway starts returning 429 once the limit is passed.

Hint 1 - the plugin object

Kong plugins are Kubernetes resources. Create a KongPlugin (API group configuration.konghq.com/v1) in the demo namespace with plugin: rate-limiting and a config that sets a per-minute limit. For a DB-less Kong like this one, use policy: local so the count is kept in the gateway pod with no external store.

Hint 2 - attaching it to the route

A KongPlugin does nothing until a route references it. Add the annotation konghq.com/plugins=<your-plugin-name> to the web Ingress in the demo namespace (kubectl annotate ingress ...). Give Kong a few seconds to reconcile, then send more requests than your limit allows and watch for the 429.

How to Author Challenges on iximiuz Labs

Instead of providing a subpar online editing experience, iximiuz Labs offers a helper CLI tool called labctl, allowing you to use your favorite text editor (or a full-featured IDE) to write content from the comfort of your local machine.

Install labctl CLI

curl -sf https://labs.iximiuz.com/cli/install.sh | sh

This will download and install the latest version of the labctl CLI. You only need to do this once per workstation.

Authorize labctl

labctl auth login

This will open a browser window asking you to authorize labctl to access your account. You need to do it after a fresh install of labctl and repeat it whenever the auth session expires.

Pull challenge content

labctl content pull challenge rancher-kong-rate-limit-849ce3bd

This will create a local copy of the challenge content in a directory named rancher-kong-rate-limit-849ce3bd. You only need to do this once per challenge.

Stream your changes

labctl content push -fw challenge rancher-kong-rate-limit-849ce3bd

Run this command in a separate terminal to continuously upload your changes to the server while editing the challenge in your favorite text editor or IDE.

You can also use labctl to create, list, and delete your content. Learn more about the available commands: labctl content --help

Start challenge