# This example shows how to use Istio local rate limiting with descriptors to limit by path. 
# This uses the base book-info demo and adds rate limiting by path, specifically rate limiting the product page
# to 10 requests per minute, and the overall fdqn will be able to accept 100 requests per minute. 
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: filter-local-ratelimit-svc
  namespace: istio-system
spec:
  workloadSelector:

)

// Limiter defines the interface to perform request rate limiting,
// based on the interface exposed by https://pkg.go.dev/golang.org/x/time/rate#Limiter
type Limiter interface {
	// Allow reports whether an event may happen now.
	Allow() bool
}

// LimiterUnaryServerInterceptor returns a new unary server interceptors that performs request rate limiting.

ecdsFilters:
- ecdsFilter:
    '@type': type.googleapis.com/envoy.config.core.v3.TypedExtensionConfig
    name: default.httpbin-rate-limiting
    typedConfig:
      '@type': type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
      config:
        configuration: {}
        name: default.httpbin-rate-limiting
        vmConfig:
          code:
            local:

                "name": "default.httpbin-rate-limiting",
                "typedConfig": {
                    "@type": "type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm",
                    "config": {
                        "name": "default.httpbin-rate-limiting",
                        "vmConfig": {
                            "runtime": "envoy.wasm.runtime.v8",

                        "name": "default.httpbin-rate-limiting",
                        "typed_config": {
                            "@type": "type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm",
                            "config": {
                                "name": "default.httpbin-rate-limiting",
                                "vm_config": {

# - istioctl
# - documentation
area: istioctl

# releaseNotes is a markdown listing of any user facing changes. This will appear in the
# release notes.
releaseNotes:
  - |
    **Removed** `--rps-limit` flag for `istioctl bug-report` and **added** `--rq-concurrency` flag.
    The bug reporter will now limit request concurrency instead of limiting request rate to the kube

istio.io/telemetry/stats/prometheus/sidecar/Outbound/HTTP     
istio.io/telemetry/stats/prometheus/sidecar/Outbound/TCP      
default.display-metadata                                      envoy.extensions.filters.http.wasm.v3.Wasm

# specific language governing permissions and limitations
# under the License.

#libreoffice --headless --convert-to svg src/site/xdoc/maven-deps.odg
# CLI export keeps full A3 page
# I prefer doing it by hand, limiting export to "selection" = avoids extra space

# svgo https://github.com/svg/svgo
svgo --config src/site/svgo.config.mjs maven-deps.svg -o maven-deps-optimized.svg

cat maven-deps-optimized.svg \

	//
	// Set this to something reasonable so request to webhooks don't hang forever.
	clientConfig.Timeout = defaultRequestTimeout

	// Avoid client-side rate limiting talking to the webhook backend.
	// Rate limiting should happen when deciding how many requests to serve.
	clientConfig.QPS = -1

	return clientConfig, nil

// file descriptor so we limit this to less than the number of
// permitted open files. On some systems, notably Darwin, if
// getaddrinfo is unable to open a file descriptor it simply returns
// EAI_NONAME rather than a useful error. Limiting the number of
// concurrent getaddrinfo calls to less than the permitted number of
// file descriptors makes that error less likely. We don't bother to
// apply the same limit to DNS lookups run directly from Go, because