Envoy 本地限流与熔断（Local Rate Limit、Circuit Breaker 与验证）

概述本地限流在每实例层面限制请求速率, 熔断通过连接数与并发请求上限保护后端。两者协同可在突发流量与下游故障时维持网关稳定性。关键实践与参数令牌桶: `tokens_per_fill` `fill_interval` 控制速率匹配范围: 针对特定路由或全部路由应用熔断阈值: `max_connections` `max_pending_requests` `max_requests`观测指标: 限流命中数、熔断触发次数与后端错误率示例/配置/实现static_resources: listeners: - name: http address: socket_address: { address: 0.0.0.0, port_value: 8080 } filter_chains: - filters: - name: envoy.filters.network.http_connection_manager typed_config: "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager route_config: virtual_hosts: - name: app domains: ["*"] routes: - match: { prefix: "/api" } route: { cluster: api } http_filters: - name: envoy.filters.http.local_ratelimit typed_config: "@type": type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit stat_prefix: rl token_bucket: max_tokens: 100 tokens_per_fill: 100 fill_interval: 1s clusters: - name: api type: LOGICAL_DNS load_assignment: cluster_name: api endpoints: - lb_endpoints: - endpoint: address: socket_address: { address: api.svc, port_value: 80 } circuit_breakers: thresholds: - max_connections: 1000 max_pending_requests: 200 max_requests: 500 验证压测限流: 并发请求超过速率时观察被本地限流拒绝的比例与响应码熔断触发: 增加后端延迟与错误率, 验证连接与请求上限生效指标记录: 采集限流与熔断相关指标并设置告警阈值回退策略: 调整阈值并观察性能与稳定性权衡注意事项限流建议与全局或分布式限流协同熔断阈值需结合下游容量评估在多路由场景按业务优先级区分限流策略定期复盘指标与事件以优化参数