Traffic control
Rate limiting
Fixed, sliding, and token-bucket limits with route or global bindings.
Goal
Protect upstreams from abuse with rate-limit policies.
Prerequisites
- Permission
ratelimits.read/ratelimits.write. - Redis enabled for multi-node enforcement (local store works for single Proxy).
Steps
- Open Security → Rate limits.
- Create a policy: algorithm, permit count, window/burst, queue limit.
- Bind to exactly one of: global, a route, or a proxy host.
- Save (auto-publish).
Algorithms
| Algorithm | Behavior |
|---|---|
| Fixed window | Counters reset each window |
| Sliding window | Smoother limiting across window edges |
| Token bucket | Burst-friendly sustained rate |
Runtime behavior
- Middleware returns 429 with
Retry-Afterwhen denied. - Redis keys look like
sg:t:{tenantId}:rl:{policyId}:{scopeKey}. - Redis errors fail open so an outage does not blackhole traffic.
- Policies can also trigger
RateLimitactions from the WAF engine.
Verify
- Generate traffic above the limit; expect 429.
- Confirm other clients/scopes are unaffected.