Limit traffic rates from source IP addresses
This topic describes how to configure RPC and gRPC traffic rate limits for source IP addresses. This enables you to specify a budget for read and write requests to prevent any single source IP from overwhelming the Consul server and negatively affecting the network. For information about setting global traffic rate limits, refer to Set a global limit on traffic rates. For an overview of Consul's server rate limiting capabilities, refer to Limit traffic rates overview.
This feature requires Consul Enterprise. Refer to the feature compatibility matrix for additional information.
You can set limits on the rate of read and write requests from source IP addresses to specific resources, which mitigates the risks to Consul servers when consul clients send excessive requests to a specific resource type. Before configuring traffic rate limits, you should complete the initialization process to understand normal traffic loads in your network. Refer to Initialize rate limit settings for additional information.
Complete the following steps to configure traffic rate limits from a source IP address:
Define rate limits in a control plan request limit configuration entry. You can set limits for different types of resources calls.
Apply the configuration entry to enact the limits.
You should also monitor read and write rate activity and make any necessary adjustments. Refer to Monitor rate limit data for additional information.
Create a control plane request limit configuration entry in the
default partition. The configuration entry applies to all client requests targeting any partition. Refer to the control plane request limit configuration entry reference documentation for details about the available configuration parameters.
Specify the following parameters:
kind: This must be set to
name: Specify the name of the service that you want to limit read and write operations to.
read_rate: Specify overall number of read operations per second allowed from the service.
write_rate: Specify overall number of write operations per second allowed from the service.
You can also configure limits on calls to the key-value store, ACL system, and Consul catalog.
If your network is deployed to virtual machines, use the
consul config write command and specify the control plane request limit configuration entry to apply the configuration. For Kubernetes-orchestrated networks, use the
kubectl apply command.
$ consul config write control-plane-request-limit.hcl
Set the limits.request_limits.mode in the agent configuration to
disabled to allow services to exceed the specified read and write requests limits. The
disabled mode applies to all request rate limits, even limits specified in the control plane request limits configuration entry. Note that any other mode specified in the agent configuration only applies to global traffic rate limits.