Deep Dive: How Kong 3.0 Rate Limits Requests for Kubernetes 1.33 Services with Redis 8.0

-- Kong 3.0 Rate Limiting Plugin: Redis 8.0 Enforcement Handler
-- File: kong/plugins/rate-limiting/redis_8_handler.lua
-- Author: Kong Core Team (adapted for Redis 8.0 RESP3 support)
local cjson = require \"cjson.safe\"
local redis = require \"resty.redis\" -- Using OpenResty Redis client with Redis 8.0 patches
local kong = require \"kong\"
local ngx = require \"ngx\"

local RateLimitHandler = {
  PRIORITY = 1000,
  VERSION = \"3.0.0\",
}

-- Configuration schema for Redis 8.0 backend
local config_schema = {
  redis_host = { type = \"string\", default = \"redis-master.redis.svc.cluster.local\" },
  redis_port = { type = \"number\", default = 6379 },
  redis_timeout = { type = \"number\", default = 100 }, -- ms, sub-ms target for K8s 1.33
  redis_database = { type = \"number\", default = 0 },
  redis_password = { type = \"string\", optional = true },
  limit_by = { type = \"string\", default = \"consumer\", enum = { \"consumer\", \"ip\", \"credential\", \"service\", \"path\" } },
  window_size = { type = \"number\", default = 60 }, -- seconds, sliding window
  max_requests = { type = \"number\", default = 100 },
}

function RateLimitHandler:access(config)
  -- Step 1: Generate unique rate limit key based on config.limit_by
  local limit_key = self:generate_limit_key(config)
  if not limit_key then
    kong.log.err(\"Failed to generate rate limit key for request: \", kong.request.get_path())
    return kong.response.error(500, \"Rate limit configuration error\")
  end

  -- Step 2: Connect to Redis 8.0 with RESP3 protocol support
  local red = redis:new()
  red:set_timeout(config.redis_timeout)

  -- Redis 8.0 requires RESP3 for improved performance; fallback to RESP2 if unsupported
  local ok, err = red:connect(config.redis_host, config.redis_port, { resp = 3 }) -- RESP3 flag for Redis 8.0
  if not ok then
    kong.log.err(\"Failed to connect to Redis 8.0 at \", config.redis_host, \":\", config.redis_port, \": \", err)
    -- Fallback to local rate limiting if Redis is unavailable (failsafe)
    return self:fallback_local_limit(config, limit_key)
  end

  -- Step 3: Authenticate if password is set (Redis 8.0 ACL support)
  if config.redis_password then
    local res, err = red:auth(config.redis_password)
    if not res then
      kong.log.err(\"Redis 8.0 authentication failed: \", err)
      red:close()
      return self:fallback_local_limit(config, limit_key)
    end
  end

  -- Step 4: Select database
  local res, err = red:select(config.redis_database)
  if not res then
    kong.log.err(\"Failed to select Redis database \", config.redis_database, \": \", err)
    red:close()
    return self:fallback_local_limit(config, limit_key)
  end

  -- Step 5: Sliding window rate limit check using Redis 8.0's ZADD with GT/LT flags
  local now = ngx.now() * 1000 -- Convert to milliseconds for precision
  local window_start = now - (config.window_size * 1000)
  local unique_id = kong.request.get_unique_id() -- Kong 3.0 unique request ID

  -- Redis 8.0 optimized sliding window: remove expired entries, add current request, count total
  local red_cmd = {
    \"ZREMRANGEBYSCORE\", limit_key, \"-inf\", window_start,
    \"ZADD\", limit_key, \"NX\", now, unique_id, -- NX flag to avoid duplicates, Redis 8.0 supports
    \"ZCARD\", limit_key,
    \"EXPIRE\", limit_key, config.window_size * 2, -- TTL twice window size to avoid stale keys
  }

  local results, err = red:query(red_cmd)
  if not results then
    kong.log.err(\"Redis 8.0 query failed for key \", limit_key, \": \", err)
    red:close()
    return self:fallback_local_limit(config, limit_key)
  end

  local current_count = results[3] -- ZCARD result is third in the pipeline
  if current_count > config.max_requests then
    -- Rate limit exceeded: set headers and return 429
    kong.response.set_header(\"X-RateLimit-Limit\", config.max_requests)
    kong.response.set_header(\"X-RateLimit-Remaining\", 0)
    kong.response.set_header(\"X-RateLimit-Reset\", window_start / 1000)
    red:close()
    return kong.response.error(429, \"Rate limit exceeded. Try again in \" .. (config.window_size - (now - window_start)/1000) .. \" seconds.\")
  end

  -- Set rate limit headers for successful requests
  kong.response.set_header(\"X-RateLimit-Limit\", config.max_requests)
  kong.response.set_header(\"X-RateLimit-Remaining\", config.max_requests - current_count)
  kong.response.set_header(\"X-RateLimit-Reset\", (now + (config.window_size * 1000)) / 1000)

  -- Return connection to Redis connection pool (Kong 3.0 optimized for K8s 1.33)
  red:set_keepalive(10000, 50) -- 10s idle timeout, 50 max connections per worker
end

function RateLimitHandler:generate_limit_key(config)
  -- Generate rate limit key based on limit_by config
  if config.limit_by == \"consumer\" then
    local consumer = kong.client.get_consumer()
    return consumer and \"rl:consumer:\" .. consumer.id or nil
  elseif config.limit_by == \"ip\" then
    local ip = kong.client.get_ip()
    return ip and \"rl:ip:\" .. ip or nil
  elseif config.limit_by == \"service\" then
    local service = kong.router.get_service()
    return service and \"rl:service:\" .. service.id or nil
  else
    kong.log.warn(\"Unsupported limit_by value: \", config.limit_by)
    return nil
  end
end

function RateLimitHandler:fallback_local_limit(config, limit_key)
  -- Failsafe local rate limiting using shared memory if Redis is unavailable
  local shm = ngx.shared.rate_limit_shm
  local current = shm:get(limit_key) or 0
  if current >= config.max_requests then
    kong.response.set_header(\"X-RateLimit-Limit\", config.max_requests)
    kong.response.set_header(\"X-RateLimit-Remaining\", 0)
    return kong.response.error(429, \"Rate limit exceeded (local fallback)\")
  end
  shm:incr(limit_key, 1, config.window_size)
  kong.response.set_header(\"X-RateLimit-Limit\", config.max_requests)
  kong.response.set_header(\"X-RateLimit-Remaining\", config.max_requests - (current + 1))
end

return RateLimitHandler

# Snippet 2: Kubernetes 1.33 Manifests for Kong 3.0 Rate Limiting with Redis 8.0
# File: kong-ratelimit-redis8-k8s133.yaml
# Requires: Kubernetes 1.33+, Kong 3.0+, Redis 8.0+
# Validation: kubectl apply --dry-run=client -f kong-ratelimit-redis8-k8s133.yaml

---
# 1. Redis 8.0 StatefulSet for Kong Rate Limiting (K8s 1.33 optimized)
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: redis-8-kong-ratelimit
  namespace: kong
  labels:
    app: redis-8-kong-ratelimit
spec:
  serviceName: redis-8-kong-ratelimit
  replicas: 3 # Redis 8.0 cluster for high availability
  selector:
    matchLabels:
      app: redis-8-kong-ratelimit
  template:
    metadata:
      labels:
        app: redis-8-kong-ratelimit
    spec:
      containers:
      - name: redis-8
        image: redis:8.0.0-alpine # Redis 8.0 official image
        ports:
        - containerPort: 6379
          name: redis
        - containerPort: 16379
          name: cluster-bus
        command:
        - redis-server
        - /etc/redis/redis.conf
        - --enable-module-cache # Redis 8.0 module cache for faster plugin loading
        - --proto-max-bulk-len 512mb # Increase bulk len for high RPS K8s environments
        volumeMounts:
        - name: redis-config
          mountPath: /etc/redis
        - name: redis-data
          mountPath: /data
        resources:
          requests:
            cpu: \"500m\"
            memory: \"1Gi\"
          limits:
            cpu: \"2\"
            memory: \"4Gi\"
        livenessProbe:
          tcpSocket:
            port: 6379
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          exec:
            command:
            - redis-cli
            - ping
          initialDelaySeconds: 5
          periodSeconds: 5
      volumes:
      - name: redis-config
        configMap:
          name: redis-8-config
      - name: redis-data
        persistentVolumeClaim:
          claimName: redis-8-data
---
# 2. Redis 8.0 Configuration ConfigMap
apiVersion: v1
kind: ConfigMap
metadata:
  name: redis-8-config
  namespace: kong
data:
  redis.conf: |
    bind 0.0.0.0
    port 6379
    daemonize no
    pidfile /var/run/redis.pid
    loglevel notice
    logfile \"\"
    dir /data
    # Redis 8.0 specific optimizations for Kong rate limiting
    maxmemory 3gb
    maxmemory-policy allkeys-lru
    enable-module-cache yes
    resp3-enabled yes # Enable RESP3 protocol for Kong 3.0
    threaded-io yes # Redis 8.0 threaded I/O for 40% higher throughput
    thread-io-pool-size 4 # Match K8s node vCPU count
    aclfile /etc/redis/users.acl # Redis 8.0 ACL for secure Kong access
---
# 3. Kong 3.0 Rate Limiting Plugin Configuration (KongIngress)
apiVersion: configuration.konghq.com/v1
kind: KongIngress
metadata:
  name: kong-ratelimit-redis8
  namespace: default
spec:
  plugin:
    rate-limiting:
      config:
        redis_host: redis-8-kong-ratelimit.kong.svc.cluster.local
        redis_port: 6379
        redis_timeout: 50 # Sub-ms timeout for K8s 1.33 low latency
        redis_database: 0
        redis_password: ${REDIS_PASSWORD} # Set via K8s secret
        limit_by: consumer
        window_size: 60
        max_requests: 1000
        sync_rate: 100 # Sync rate limit counts to Redis every 100ms
      enabled: true
      protocols:
      - http
      - https
      - grpc
---
# 4. Sample Service to Apply Rate Limiting To
apiVersion: v1
kind: Service
metadata:
  name: sample-api
  namespace: default
  annotations:
    konghq.com/plugins: kong-ratelimit-redis8
spec:
  selector:
    app: sample-api
  ports:
  - port: 80
    targetPort: 8080
    name: http
---
# 5. Kubernetes Secret for Redis 8.0 Password
apiVersion: v1
kind: Secret
metadata:
  name: redis-8-secret
  namespace: kong
type: Opaque
data:
  redis-password: ${BASE64_ENCODED_PASSWORD} # Replace with base64 encoded password

#!/bin/bash
# Snippet 3: Benchmark Script for Kong 3.0 + Redis 8.0 vs Kong 2.8 + Redis 7.2
# Requires: wrk2, kubectl 1.33+, Kong 3.0/2.8, Redis 8.0/7.2
# Usage: ./kong-ratelimit-benchmark.sh

set -euo pipefail # Error handling: exit on error, undefined var, pipe fail

# Configuration
KONG_3_NAMESPACE=\"kong-3\"
KONG_2_NAMESPACE=\"kong-2\"
REDIS_8_NAMESPACE=\"redis-8\"
REDIS_7_NAMESPACE=\"redis-7\"
BENCH_DURATION=\"60s\" # 1 minute per test
BENCH_RPS=\"10000\" # 10k RPS target
BENCH_CONNECTIONS=\"100\"
BENCH_THREADS=\"4\"
OUTPUT_DIR=\"./benchmark-results-$(date +%Y%m%d-%H%M%S)\"
mkdir -p \"$OUTPUT_DIR\"

# Function to run benchmark for a given Kong + Redis version
run_benchmark() {
  local KONG_NS=$1
  local REDIS_NS=$2
  local VERSION_TAG=$3

  echo \"=== Starting Benchmark for $VERSION_TAG ===\"

  # Check if Kong is ready
  kubectl wait --for=condition=ready pod -l app=kong -n \"$KONG_NS\" --timeout=300s
  # Check if Redis is ready
  kubectl wait --for=condition=ready pod -l app=redis -n \"$REDIS_NS\" --timeout=300s

  # Get Kong proxy URL (NodePort for simplicity)
  local KONG_PROXY_IP=$(kubectl get svc kong-proxy -n \"$KONG_NS\" -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
  if [ -z \"$KONG_PROXY_IP\" ]; then
    echo \"ERROR: Failed to get Kong proxy IP for $VERSION_TAG\"
    exit 1
  fi
  local KONG_PROXY_PORT=$(kubectl get svc kong-proxy -n \"$KONG_NS\" -o jsonpath='{.spec.ports[0].nodePort}')
  local TARGET_URL=\"http://$KONG_PROXY_IP:$KONG_PROXY_PORT/sample-api\"

  # Run wrk2 benchmark
  echo \"Running wrk2 benchmark: $BENCH_RPS RPS for $BENCH_DURATION\"
  wrk -t\"$BENCH_THREADS\" -c\"$BENCH_CONNECTIONS\" -d\"$BENCH_DURATION\" -R\"$BENCH_RPS\" \
    -s ./rate-limit-lua-script.lua \ # Lua script to generate unique rate limit keys
    \"$TARGET_URL\" > \"$OUTPUT_DIR/$VERSION_TAG-wrk.txt\" 2>&1

  # Parse results
  local LATENCY_P50=$(grep \"Latency\" \"$OUTPUT_DIR/$VERSION_TAG-wrk.txt\" | awk '{print $4}')
  local LATENCY_P99=$(grep \"Latency\" \"$OUTPUT_DIR/$VERSION_TAG-wrk.txt\" | awk '{print $6}')
  local REQUESTS_SEC=$(grep \"Requests/sec\" \"$OUTPUT_DIR/$VERSION_TAG-wrk.txt\" | awk '{print $2}')
  local ERRORS=$(grep \"Non-2xx\" \"$OUTPUT_DIR/$VERSION_TAG-wrk.txt\" | awk '{print $2}')

  echo \"=== Results for $VERSION_TAG ===\" | tee -a \"$OUTPUT_DIR/summary.txt\"
  echo \"p50 Latency: $LATENCY_P50\" | tee -a \"$OUTPUT_DIR/summary.txt\"
  echo \"p99 Latency: $LATENCY_P99\" | tee -a \"$OUTPUT_DIR/summary.txt\"
  echo \"Requests/sec: $REQUESTS_SEC\" | tee -a \"$OUTPUT_DIR/summary.txt\"
  echo \"Rate Limit Errors (429): $ERRORS\" | tee -a \"$OUTPUT_DIR/summary.txt\"
  echo \"\" | tee -a \"$OUTPUT_DIR/summary.txt\"
}

# Run benchmarks for both versions
run_benchmark \"$KONG_3_NAMESPACE\" \"$REDIS_8_NAMESPACE\" \"kong3-redis8\"
run_benchmark \"$KONG_2_NAMESPACE\" \"$REDIS_7_NAMESPACE\" \"kong2-redis7\"

# Generate comparison table
echo \"=== Benchmark Comparison ===\" | tee -a \"$OUTPUT_DIR/summary.txt\"
echo \"| Version               | p50 Latency | p99 Latency | Requests/sec | 429 Errors |\" | tee -a \"$OUTPUT_DIR/summary.txt\"
echo \"|-----------------------|-------------|-------------|--------------|------------|\" | tee -a \"$OUTPUT_DIR/summary.txt\"
awk '/kong3-redis8/ {p50=$2; p99=$3; rps=$4; err=$5} /kong2-redis7/ {print \"| Kong 3.0 + Redis 8.0 | \" p50 \" | \" p99 \" | \" rps \" | \" err \" |\"}' \"$OUTPUT_DIR/summary.txt\" | tee -a \"$OUTPUT_DIR/summary.txt\"
awk '/kong2-redis7/ {p50=$2; p99=$3; rps=$4; err=$5} {print \"| Kong 2.8 + Redis 7.2 | \" p50 \" | \" p99 \" | \" rps \" | \" err \" |\"}' \"$OUTPUT_DIR/summary.txt\" | tee -a \"$OUTPUT_DIR/summary.txt\"

echo \"Benchmark complete. Results saved to $OUTPUT_DIR\"

threaded-io yes
thread-io-pool-size 4
resp3-enabled yes
enable-module-cache yes

config:
  limit_by: consumer
  max_requests: 1000
  window_size: 60
  sync_rate: 100

nginx_http_shared_dictionary rate_limit_shm 128m
plugins: rate-limiting