help request: Plug-in function consultation

[liuxiaobo007]

Description

As shown in the figure, the plug-in can request current limit for consumers, but the current limit for all consumers is the same. Can you set different restrictions for different consumers respectively?

For example, req of consumer01 is set to 2; The req of consumer02 is set to 5; The req of consumer03 is set to 4; Can it be realized?

Environment

• APISIX version (run apisix version):
• Operating system (run uname -a):
• OpenResty / Nginx version (run openresty -V or nginx -V):
• etcd version, if relevant (run curl http://127.0.0.1:9090/v1/server_info):
• APISIX Dashboard version, if relevant:
• Plugin runner version, for issues related to plugin runners:
• LuaRocks version, for installation issues (run luarocks --version):

[janiussyafiq]

Hi @liuxiaobo007 , this can be achieved by setting the limit-req plugin within each consumer. Here is an example for your use-case:

1. Create two consumers with key-auth and limit-req with different config.

curl -s http://127.0.0.1:9180/apisix/admin/consumers \
    -H "X-API-KEY: $admin_key" \
    -X PUT -d '{
        "username": "consumer-1",
        "plugins": {
            "key-auth": {
                "key": "key-1"
            },
            "limit-req": {
                "rate": 1,
                "burst": 0,
                "key": "consumer_name",
                "key_type": "var",
                "rejected_code": 429
            }
        }
    }'
    
curl -s http://127.0.0.1:9180/apisix/admin/consumers \
    -H "X-API-KEY: $admin_key" \
    -X PUT -d '{
        "username": "consumer-2",
        "plugins": {
            "key-auth": {
                "key": "key-2"
            },
            "limit-req": {
                "rate": 2,
                "burst": 0,
                "key": "consumer_name",
                "key_type": "var",
                "rejected_code": 429
            }
        }
    }'

2. Create a route

curl -s http://127.0.0.1:9180/apisix/admin/routes/1 \
    -H "X-API-KEY: $admin_key" \
    -X PUT -d '{
        "uri": "/anything",
        "plugins": {
            "key-auth": {}
        },
        "upstream": {
            "type": "roundrobin",
            "nodes": {
                "127.0.0.1:8080": 1
            }
        }
    }'

3. Run an upstream container within local machine for low latency request (optional, can use other as well)

docker run --network host -P ghcr.io/mccutchen/go-httpbin

4. Hit the route as consumer-1.

for i in $(seq 1 3); do
    echo -n "req $i: "
    curl -s -o /dev/null -w "%{http_code}" \
    http://127.0.0.1:9080/anything \
    -H 'apikey: key-1'
    echo
done

# result
req 1: 200
req 2: 429
req 3: 429

5. Hit the route as consumer-2.

for i in 1 2 3; do
    echo -n "Req $i at $(date +%S.%3N)s -> Status: "
    curl -s -o /dev/null -w "%{http_code}\n" \
        http://127.0.0.1:9080/anything \
        -H 'apikey: key-2'
    
    # After the first request, wait to clear the bucket
    # After the second, fire immediately to trigger the limit
    if [ $i -eq 1 ]; then 
        sleep 0.51
    fi
done

# result
Req 1 at 37.567s -> Status: 200
Req 2 at 38.097s -> Status: 200
Req 3 at 38.109s -> Status: 429

From here we can see each consumer has different limit-req quota. Let me know if u have any further clarifying question :)

Reference: https://apisix.apache.org/docs/apisix/terminology/consumer/#example

[liuxiaobo007]

Hi @liuxiaobo007 , this can be achieved by setting the limit-req plugin within each consumer. Here is an example for your use-case:

1. Create two consumers with key-auth and limit-req with different config.

curl -s http://127.0.0.1:9180/apisix/admin/consumers
-H "X-API-KEY: $admin_key"
-X PUT -d '{
"username": "consumer-1",
"plugins": {
"key-auth": {
"key": "key-1"
},
"limit-req": {
"rate": 1,
"burst": 0,
"key": "consumer_name",
"key_type": "var",
"rejected_code": 429
}
}
}'

curl -s http://127.0.0.1:9180/apisix/admin/consumers
-H "X-API-KEY: $admin_key"
-X PUT -d '{
"username": "consumer-2",
"plugins": {
"key-auth": {
"key": "key-2"
},
"limit-req": {
"rate": 2,
"burst": 0,
"key": "consumer_name",
"key_type": "var",
"rejected_code": 429
}
}
}'
2. Create a route

curl -s http://127.0.0.1:9180/apisix/admin/routes/1
-H "X-API-KEY: $admin_key"
-X PUT -d '{
"uri": "/anything",
"plugins": {
"key-auth": {}
},
"upstream": {
"type": "roundrobin",
"nodes": {
"127.0.0.1:8080": 1
}
}
}'
3. Run an upstream container within local machine for low latency request (optional, can use other as well)

docker run --network host -P ghcr.io/mccutchen/go-httpbin
4. Hit the route as consumer-1.

for i in $(seq 1 3); do
echo -n "req $i: "
curl -s -o /dev/null -w "%{http_code}"
http://127.0.0.1:9080/anything
-H 'apikey: key-1'
echo
done

result

req 1: 200
req 2: 429
req 3: 429
5. Hit the route as consumer-2.

for i in 1 2 3; do
echo -n "Req $i at $(date +%S.%3N)s -> Status: "
curl -s -o /dev/null -w "%{http_code}\n"
http://127.0.0.1:9080/anything
-H 'apikey: key-2'

# After the first request, wait to clear the bucket
# After the second, fire immediately to trigger the limit
if [ $i -eq 1 ]; then 
    sleep 0.51
fi

done

result

Req 1 at 37.567s -> Status: 200
Req 2 at 38.097s -> Status: 200
Req 3 at 38.109s -> Status: 429
From here we can see each consumer has different limit-req quota. Let me know if u have any further clarifying question :)

Reference: https://apisix.apache.org/docs/apisix/terminology/consumer/#example

Thank you for your answer. I have seen this article in the official, and I think there are some defects:

If the current limiting plug-in is bound to the consumer, then the quota of each consumer is fixed, and this consumer will be subject to the same restrictions no matter which route he requests.

I want to set different consumer restrictions for different routes:

The limit of route a: Consumer01 is 2; The limit of consumer02 is 5; Consumer03 has a limit of 8.

The limit of route b: Consumer01 is 5; The limit of consumer02 is 2; Consumer03 has a limit of 3.

This method requires the current limiting plug-in to set multiple current limiting rules at the same time, and each current limiting rule can specify one or more consumers.

[janiussyafiq]

I think u can utilize workflow plugin as a native solution for APISIX, you can refer it here (your exact use case): https://apisix.apache.org/docs/apisix/plugins/workflow/#apply-rate-limiting-conditionally-by-consumers

However, according to the documentation, as of now it doesn't support limit-req and only supports limit-count and limit-conn. If u wanna work with limit-req, I believe you can submit a feature request for it to be added into the current workflow plugin. Let me know if this suits your situation.