api: support rate limit action based on cidr match by rudrakhp · Pull Request #42845 · envoyproxy/envoy

rudrakhp · 2026-01-04T17:43:26Z

Commit Message: [api] support rate limit action based on cidr match
Additional Description: Proposed API changes to support rate limit actions on remote address match. This includes additions of a new rate limit action RemoteAddressMatch as well as inclusion of a CIDR matcher in the MaskedRemoteAddress action.
Risk Level: Low (doesn't break/affect existing usecases)
Testing: N/A (API changes only)
Docs Changes: N/A
Release Notes: N/A
Platform Specific Features: N/A
[Optional Runtime guard:]
Related #36442
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
Optional API Considerations:

RemoteAddressMatch rate limit action will cater to usecases that need to match on remote address.
Need to enhance substitution formatter to support %MASKED_REMOTE_ADDRESS(prefix_len)%.
Reusing existing type.matcher.v3.AddressMatcher. Need to implement invert_match in existing usage at FilterStateIpRangeMatcher::match.

repokitteh-read-only · 2026-01-04T17:43:35Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to (api/envoy/|docs/root/api-docs/).
envoyproxy/api-shepherds assignee is @adisuissa
CC @envoyproxy/api-watchers: FYI only for changes made to (api/envoy/|docs/root/api-docs/).

🐱

Caused by: #42845 was opened by rudrakhp.

see: more, trace.

agrawroh

Just curios, why can't we use the existing Dynamic Metadata for this? It should be trivial to write Dynamic Metadata for Remote Address and use that instead right?

rudrakhp · 2026-01-05T04:05:30Z

@agrawroh the challenge here is not to apply rate limits to remote address ,in fact we already have the RemoteAddress rate limit action for this and can also use GenericKey with CEL without any dynamic metadata. But the usecase here is to apply different rate limits to remote addresses matching on some CIDRs. See the referred issue #36442 and also the related envoyproxy/gateway#4385 issue.

wbpcode

Thanks for the contribution and some comments are added.

rudrakhp · 2026-01-13T07:52:42Z

/retest

adisuissa

Thanks!
I think that matching is a good feature to have, I just wonder whether it could be more generic.

adisuissa · 2026-01-14T14:29:39Z

+
+      // [#not-implemented-hide:]
+      // Rate limit on remote address match.
+      RemoteAddressMatch remote_address_match = 13;


I think this new field is confusing because there are already remote_address and remote_address_match. I think calrifying the reasoning behind this feature is the first step. I'm not an expert in this domain, but I would suggest one of the following:

consider adding options to RemoteAddress and MaskedRemoteAddress that enables the matching (the reasoning behind this is that I think that matching is more generic and orthogonal to whether the matched object is a remote address, a request header, etc).

See if this should be a typed-extension (using the extension field).

cc @wbpcode due to the comment in #36442

@adisuissa thanks for the comment. This is supposed to handle all the remote address matching usecases in a generic way by leveraging CEL and substitution formatting in descriptor_value. For example:

Using %DOWNSTREAM_REMOTE_ADDRESS% here will handle the existing RemoteAddress usecase with CIDR matching.

We might need to introduce formatter like %MASKED_DOWNSTREAM_REMOTE_ADDRESS(len)% to handle MaskedRemoteAddress usecase with CIDR matching. See feat: add formatters for masked IP addresses #42969 .

@wbpcode is aligned with the RemoteAddressMatch approach (see comments above), if the name is confusing I will think of some alternatives.

^ bump @adisuissa @wbpcode
How does remote_address_range_match / remote_address_value_match sound instead of remote_address_match?

@wbpcode is the expert on substitution formatters. I'm just presenting my thoughts on design and combination of features.

Sure, thanks for your inputs!

There are some similar patterns:

request_headers vs header_value_match, query_parameters vs query_parameter_value_match, the former will use the content of header/query as the descriptor value, the latter use a matcher to match the header/query's content and use some other unrelated values as descriptor value.

This is the same pattern for RemoteAddress and RemoteAddressMatch

It's hard to add match option in the RemoteAddress and get similar result.

Hello, @adisuissa , is this a block point for you?

Whatever you decide.
My 2cents is that if there are repeated sub-configurations that will be needed in different places, then it suggests a design smell, but I'm not against the current suggestion.

IMO we must mark the RemoteAddress and MaskedRemoteAddress as deprecated options after this implementation goes in. CEL should be the way forward instead of having dedicated rate limit actions for each usecase. That should also help address @adisuissa's comment regarding repeated sub-configurations.

Commit Message: Add formatters for masked IP addresses Additional Description: Added masked alternatives for supported substitution formatters that return IP addresses today Risk Level: Low Testing: Unit testing Docs Changes: Added the new substitution formatters to docs Release Notes: Yes Platform Specific Features: N/A Related: #42845 (comment) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

rudrakhp · 2026-02-04T08:30:17Z

/retest

Commit Message: Additional Description: Support rate limit actions on remote address match. Includes implementation `invert_match` for address matcher. Risk Level: Low Testing: Unit testing Docs Changes: n/a Release Notes: Yes Platform Specific Features: [Optional Runtime guard:] Fixes #36442 Implements API introduced in #42845 Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

Commit Message: Add formatters for masked IP addresses Additional Description: Added masked alternatives for supported substitution formatters that return IP addresses today Risk Level: Low Testing: Unit testing Docs Changes: Added the new substitution formatters to docs Release Notes: Yes Platform Specific Features: N/A Related: envoyproxy#42845 (comment) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

Commit Message: [api] support rate limit action based on cidr match Additional Description: Proposed API changes to support rate limit actions on remote address match. This includes additions of a new rate limit action `RemoteAddressMatch` as well as inclusion of a CIDR matcher in the `MaskedRemoteAddress` action. Risk Level: Low (doesn't break/affect existing usecases) Testing: N/A (API changes only) Docs Changes: N/A Release Notes: N/A Platform Specific Features: N/A [Optional Runtime guard:] Related envoyproxy#36442 [Optional Fixes commit #PR or SHA] [Optional Deprecated:] Optional [API Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md): * `RemoteAddressMatch` rate limit action will cater to usecases that need to match on remote address. * Need to enhance substitution formatter to support `%MASKED_REMOTE_ADDRESS(prefix_len)%`. * Reusing existing `type.matcher.v3.AddressMatcher`. Need to implement `invert_match` in existing usage at `FilterStateIpRangeMatcher::match`. Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

Commit Message: Additional Description: Support rate limit actions on remote address match. Includes implementation `invert_match` for address matcher. Risk Level: Low Testing: Unit testing Docs Changes: n/a Release Notes: Yes Platform Specific Features: [Optional Runtime guard:] Fixes envoyproxy#36442 Implements API introduced in envoyproxy#42845 Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

Commit Message: [api] support rate limit action based on cidr match Additional Description: Proposed API changes to support rate limit actions on remote address match. This includes additions of a new rate limit action `RemoteAddressMatch` as well as inclusion of a CIDR matcher in the `MaskedRemoteAddress` action. Risk Level: Low (doesn't break/affect existing usecases) Testing: N/A (API changes only) Docs Changes: N/A Release Notes: N/A Platform Specific Features: N/A [Optional Runtime guard:] Related envoyproxy#36442 [Optional Fixes commit #PR or SHA] [Optional Deprecated:] Optional [API Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md): * `RemoteAddressMatch` rate limit action will cater to usecases that need to match on remote address. * Need to enhance substitution formatter to support `%MASKED_REMOTE_ADDRESS(prefix_len)%`. * Reusing existing `type.matcher.v3.AddressMatcher`. Need to implement `invert_match` in existing usage at `FilterStateIpRangeMatcher::match`. Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: nick <nickshokri@google.com>

Commit Message: Additional Description: Support rate limit actions on remote address match. Includes implementation `invert_match` for address matcher. Risk Level: Low Testing: Unit testing Docs Changes: n/a Release Notes: Yes Platform Specific Features: [Optional Runtime guard:] Fixes envoyproxy#36442 Implements API introduced in envoyproxy#42845 Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: nick <nickshokri@google.com>

Commit Message: [api] support rate limit action based on cidr match Additional Description: Proposed API changes to support rate limit actions on remote address match. This includes additions of a new rate limit action `RemoteAddressMatch` as well as inclusion of a CIDR matcher in the `MaskedRemoteAddress` action. Risk Level: Low (doesn't break/affect existing usecases) Testing: N/A (API changes only) Docs Changes: N/A Release Notes: N/A Platform Specific Features: N/A [Optional Runtime guard:] Related envoyproxy#36442 [Optional Fixes commit #PR or SHA] [Optional Deprecated:] Optional [API Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md): * `RemoteAddressMatch` rate limit action will cater to usecases that need to match on remote address. * Need to enhance substitution formatter to support `%MASKED_REMOTE_ADDRESS(prefix_len)%`. * Reusing existing `type.matcher.v3.AddressMatcher`. Need to implement `invert_match` in existing usage at `FilterStateIpRangeMatcher::match`. Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: nick <nickshokri@google.com>

Commit Message: Additional Description: Support rate limit actions on remote address match. Includes implementation `invert_match` for address matcher. Risk Level: Low Testing: Unit testing Docs Changes: n/a Release Notes: Yes Platform Specific Features: [Optional Runtime guard:] Fixes envoyproxy#36442 Implements API introduced in envoyproxy#42845 Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: nick <nickshokri@google.com>

Commit Message: Add formatters for masked IP addresses Additional Description: Added masked alternatives for supported substitution formatters that return IP addresses today Risk Level: Low Testing: Unit testing Docs Changes: Added the new substitution formatters to docs Release Notes: Yes Platform Specific Features: N/A Related: envoyproxy#42845 (comment) Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: Gustavo <grnmeira@gmail.com>

Commit Message: [api] support rate limit action based on cidr match Additional Description: Proposed API changes to support rate limit actions on remote address match. This includes additions of a new rate limit action `RemoteAddressMatch` as well as inclusion of a CIDR matcher in the `MaskedRemoteAddress` action. Risk Level: Low (doesn't break/affect existing usecases) Testing: N/A (API changes only) Docs Changes: N/A Release Notes: N/A Platform Specific Features: N/A [Optional Runtime guard:] Related envoyproxy#36442 [Optional Fixes commit #PR or SHA] [Optional Deprecated:] Optional [API Considerations](https://github.com/envoyproxy/envoy/blob/main/api/review_checklist.md): * `RemoteAddressMatch` rate limit action will cater to usecases that need to match on remote address. * Need to enhance substitution formatter to support `%MASKED_REMOTE_ADDRESS(prefix_len)%`. * Reusing existing `type.matcher.v3.AddressMatcher`. Need to implement `invert_match` in existing usage at `FilterStateIpRangeMatcher::match`. Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com> Signed-off-by: Gustavo <grnmeira@gmail.com>

Commit Message: Additional Description: Support rate limit actions on remote address match. Includes implementation `invert_match` for address matcher. Risk Level: Low Testing: Unit testing Docs Changes: n/a Release Notes: Yes Platform Specific Features: [Optional Runtime guard:] Fixes envoyproxy#36442 Implements API introduced in envoyproxy#42845 Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

repokitteh-read-only Bot added the api label Jan 4, 2026

repokitteh-read-only Bot assigned adisuissa Jan 4, 2026

agrawroh reviewed Jan 4, 2026

View reviewed changes

rudrakhp requested a review from agrawroh January 5, 2026 04:05

rudrakhp force-pushed the api_cidr_matcher branch from 75d5207 to 42e82a7 Compare January 5, 2026 04:18

wbpcode reviewed Jan 5, 2026

View reviewed changes

Comment thread api/envoy/config/route/v3/route_components.proto Outdated

Comment thread api/envoy/config/route/v3/route_components.proto

rudrakhp requested a review from wbpcode January 6, 2026 04:45

rudrakhp force-pushed the api_cidr_matcher branch from 42e82a7 to 82f2214 Compare January 13, 2026 06:07

rudrakhp mentioned this pull request Jan 13, 2026

feat: add formatters for masked IP addresses #42969

Merged

adisuissa reviewed Jan 14, 2026

View reviewed changes

wbpcode previously approved these changes Feb 3, 2026

View reviewed changes

repokitteh-read-only Bot removed the api label Feb 3, 2026

rudrakhp dismissed wbpcode’s stale review via 7df230d February 4, 2026 06:29

rudrakhp force-pushed the api_cidr_matcher branch from 82f2214 to 7df230d Compare February 4, 2026 06:29

repokitteh-read-only Bot added the api label Feb 4, 2026

api: support rate limit action based on cidr match

43251ef

Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>

rudrakhp force-pushed the api_cidr_matcher branch from 7df230d to 43251ef Compare February 4, 2026 06:37

rudrakhp requested a review from wbpcode February 4, 2026 06:38

wbpcode approved these changes Feb 4, 2026

View reviewed changes

repokitteh-read-only Bot removed the api label Feb 4, 2026

wbpcode merged commit 7dc9d36 into envoyproxy:main Feb 4, 2026
26 checks passed

rudrakhp mentioned this pull request Feb 4, 2026

feat: support rate limit action based on cidr match #43320

Merged

rudrakhp mentioned this pull request Mar 26, 2026

feat: support invert in source match envoyproxy/gateway#8407

Merged

Conversation

rudrakhp commented Jan 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

repokitteh-read-only Bot commented Jan 4, 2026

Uh oh!

agrawroh left a comment

Choose a reason for hiding this comment

Uh oh!

rudrakhp commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wbpcode left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

rudrakhp commented Jan 13, 2026

Uh oh!

adisuissa left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

wbpcode Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rudrakhp commented Feb 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rudrakhp commented Jan 4, 2026 •

edited

Loading

rudrakhp commented Jan 5, 2026 •

edited

Loading

wbpcode Jan 28, 2026 •

edited

Loading