- --healthz-port=8086
    - --gce-ratelimit=ga.Operations.Get,qps,10,100
    - --gce-ratelimit=alpha.Operations.Get,qps,10,100
    - --gce-ratelimit=beta.Operations.Get,qps,10,100
    - --gce-ratelimit=ga.BackendServices.Get,qps,1.8,1
    - --gce-ratelimit=beta.BackendServices.Get,qps,1.8,1
    - --gce-ratelimit=ga.HealthChecks.Get,qps,1.8,1
    - --gce-ratelimit=alpha.HealthChecks.Get,qps,1.8,1

	// HTTPConnectionManager network filter
	HTTPConnectionManager = "envoy.filters.network.http_connection_manager"
	// TCPProxy network filter
	TCPProxy = "envoy.filters.network.tcp_proxy"
	// RateLimit network filter
	RateLimit = "envoy.filters.network.ratelimit"
	// MongoProxy network filter
	MongoProxy = "envoy.filters.network.mongo_proxy"
	// ThriftProxy network filter
	ThriftProxy = "envoy.filters.network.thrift_proxy"

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: filter-local-ratelimit-svc
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      app: clt
  configPatches:
    - applyTo: HTTP_FILTER
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.local_ratelimit
          typed_config:
            "@type": type.googleapis.com/udpa.type.v1.TypedStruct

apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: filter-local-ratelimit-svc
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      app: clt
  configPatches:
    - applyTo: HTTP_FILTER
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.local_ratelimit
          typed_config:
            "@type": type.googleapis.com/udpa.type.v1.TypedStruct

	if attr.GetKind().GroupKind() != api.Kind("Event") {
		return nil
	}

	// ignore all requests that specify dry-run
	// because they don't correspond to any calls to etcd,
	// they should not be affected by the ratelimit
	if attr.IsDryRun() {
		return nil
	}

	var errors []error
	// give each limit enforcer a chance to reject the event
	for _, enforcer := range a.limitEnforcers {
		if err := enforcer.accept(attr); err != nil {

					Patch: &networking.EnvoyFilter_Patch{
						Operation: networking.EnvoyFilter_Patch_MERGE,
						Value: buildPatchStruct(`{
							"typed_per_filter_config": {
								"envoy.filters.http.ratelimit": {
									"@type": "type.googleapis.com/thisisaninvalidtype"
								}
							}
						}`),
					},
					Match: &networking.EnvoyFilter_EnvoyConfigObjectMatch{