limit-conn

Description

The limit-conn Plugin limits the number of concurrent requests to your services.

Attributes

NameTypeRequiredDefaultValid valuesDescription
connintegerTrueconn > 0Maximum number of concurrent requests allowed. Requests exceeding this ratio (and below conn + burst) will be delayed (configured by default_conn_delay).
burstintegerTrueburst >= 0Number of additional concurrent requests allowed to be delayed per second. If the number exceeds this hard limit, they will get rejected immediately.
default_conn_delaynumberTruedefault_conn_delay > 0Delay in seconds to process the concurrent requests exceeding conn (and conn + burst).
only_use_default_delaybooleanFalsefalse[true,false]When set to true, the Plugin will always set a delay of default_conn_delay and would not use any other calculations.
key_typestringFalse“var”[“var”, “var_combination”]Type of user specified key to use.
keystringTrueUser specified key to base the request limiting on. If the key_type attribute is set to “var”, the key will be treated as a name of variable, like remote_addr or consumer_name. If the key_type is set to “var_combination”, the key will be a combination of variables, like $remote_addr $consumer_name. If the value of the key is empty, remote_addr will be set as the default key.
rejected_codestringFalse503[200,…,599]HTTP status code returned when the requests exceeding the threshold are rejected.
rejected_msgstringFalsenon-emptyBody of the response returned when the requests exceeding the threshold are rejected.
allow_degradationbooleanFalsefalseWhen set to true enables Plugin degradation when the Plugin is temporarily unavailable and allows requests to continue.
policystringFalse“local”[“local”, “redis”, “redis-cluster”]Rate-limiting policies to use for retrieving and increment the limit count. When set to local the counters will be locally stored in memory on the node. When set to redis counters are stored on a Redis server and will be shared across the nodes. It is done usually for global speed limiting, and setting to redis-cluster uses a Redis cluster instead of a single instance.
redis_hoststringrequired when policy is redisAddress of the Redis server. Used when the policy attribute is set to redis.
redis_portintegerFalse6379[1,…]Port of the Redis server. Used when the policy attribute is set to redis.
redis_usernamestringFalseUsername for Redis authentication if Redis ACL is used (for Redis version >= 6.0). If you use the legacy authentication method requirepass to configure Redis password, configure only the redis_password. Used when the policy is set to redis.
redis_passwordstringFalsePassword for Redis authentication. Used when the policy is set to redis or redis-cluster.
redis_sslbooleanFalsefalseIf set to true, then uses SSL to connect to redis instance. Used when the policy attribute is set to redis.
redis_ssl_verifybooleanFalsefalseIf set to true, then verifies the validity of the server SSL certificate. Used when the policy attribute is set to redis. See tcpsock:sslhandshake.
redis_databaseintegerFalse0redis_database >= 0Selected database of the Redis server (for single instance operation or when using Redis cloud with a single entrypoint). Used when the policy attribute is set to redis.
redis_timeoutintegerFalse1000[1,…]Timeout in milliseconds for any command submitted to the Redis server. Used when the policy attribute is set to redis or redis-cluster.
redis_cluster_nodesarrayrequired when policy is redis-clusterAddresses of Redis cluster nodes. Used when the policy attribute is set to redis-cluster.
redis_cluster_namestringrequired when policy is redis-clusterName of the Redis cluster service nodes. Used when the policy attribute is set to redis-cluster.
redis_cluster_sslbooleanFalsefalseIf set to true, then uses SSL to connect to redis-cluster. Used when the policy attribute is set to redis-cluster.
redis_cluster_ssl_verifybooleanFalsefalseIf set to true, then verifies the validity of the server SSL certificate. Used when the policy attribute is set to redis-cluster.

Enable Plugin

You can enable the Plugin on a Route as shown below:

limit-conn - 图1note

You can fetch the admin_key from config.yaml and save to an environment variable with the following command:

  1. admin_key=$(yq '.deployment.admin.admin_key[0].key' conf/config.yaml | sed 's/"//g')
  1. curl http://127.0.0.1:9180/apisix/admin/routes/1 \
  2. -H "X-API-KEY: $admin_key" -X PUT -d '
  3. {
  4.     "methods": ["GET"],
  5.     "uri": "/index.html",
  6.     "plugins": {
  7.         "limit-conn": {
  8.             "conn": 1,
  9.             "burst": 0,
  10.             "default_conn_delay": 0.1,
  11.             "rejected_code": 503,
  12.             "key_type": "var",
  13.             "key": "http_a"
  14.         }
  15.     },
  16.     "upstream": {
  17.         "type": "roundrobin",
  18.         "nodes": {
  19.             "127.0.0.1:1980": 1
  20.         }
  21.     }
  22. }'

You can also configure the key_type to var_combination as shown:

  1. curl http://127.0.0.1:9180/apisix/admin/routes/1 \
  2. -H "X-API-KEY: $admin_key" -X PUT -d '
  3. {
  4.     "methods": ["GET"],
  5.     "uri": "/index.html",
  6.     "plugins": {
  7.         "limit-conn": {
  8.             "conn": 1,
  9.             "burst": 0,
  10.             "default_conn_delay": 0.1,
  11.             "rejected_code": 503,
  12.             "key_type": "var_combination",
  13.             "key": "$consumer_name $remote_addr"
  14.         }
  15.     },
  16.     "upstream": {
  17.         "type": "roundrobin",
  18.         "nodes": {
  19.             "127.0.0.1:1980": 1
  20.         }
  21.     }
  22. }'

Example usage

The example above configures the Plugin to only allow one connection on this route. When more than one request is received, the Plugin will respond with a 503 HTTP status code and reject the connection:

  1. curl -i http://127.0.0.1:9080/index.html?sleep=20 &
  3. curl -i http://127.0.0.1:9080/index.html?sleep=20
  1. <html>
  2. <head><title>503 Service Temporarily Unavailable</title></head>
  3. <body>
  4. <center><h1>503 Service Temporarily Unavailable</h1></center>
  5. <hr><center>openresty</center>
  6. </body>
  7. </html>

Delete Plugin

To remove the limit-conn Plugin, you can delete the corresponding JSON configuration from the Plugin configuration. APISIX will automatically reload and you do not have to restart for this to take effect.

  1. curl http://127.0.0.1:9180/apisix/admin/routes/1 \
  2. -H "X-API-KEY: $admin_key" -X PUT -d '
  3. {
  4.     "methods": ["GET"],
  5.     "uri": "/index.html",
  6.     "id": 1,
  7.     "plugins": {
  8.     },
  9.     "upstream": {
  10.         "type": "roundrobin",
  11.         "nodes": {
  12.             "127.0.0.1:1980": 1
  13.         }
  14.     }
  15. }'

Example of application scenarios

Limit the number of concurrent WebSocket connections

Apache APISIX supports WebSocket proxy, we can use limit-conn plugin to limit the number of concurrent WebSocket connections.

  1. Create a Route, enable the WebSocket proxy and the limit-conn plugin.

    1. curl http://127.0.0.1:9180/apisix/admin/routes/1 \
    2. -H "X-API-KEY: $admin_key" -X PUT -d '
    3. {
    4.     "uri": "/ws",
    5.     "enable_websocket": true,
    6.     "plugins": {
    7.         "limit-conn": {
    8.             "conn": 1,
    9.             "burst": 0,
    10.             "default_conn_delay": 0.1,
    11.             "rejected_code": 503,
    12.             "key_type": "var",
    13.             "key": "remote_addr"
    14.         }
    15.     },
    16.     "upstream": {
    17.         "type": "roundrobin",
    18.         "nodes": {
    19.             "127.0.0.1:1980": 1
    20.         }
    21.     }
    22. }'

    The above route enables the WebSocket proxy on /ws, and limits the number of concurrent WebSocket connections to 1. More than 1 concurrent WebSocket connection will return 503 to reject the request.

  2. Initiate a WebSocket request, and the connection is established successfully.

    1. curl --include \
    2.     --no-buffer \
    3.     --header "Connection: Upgrade" \
    4.     --header "Upgrade: websocket" \
    5.     --header "Sec-WebSocket-Key: x3JJHMbDL1EzLkh9GBhXDw==" \
    6.     --header "Sec-WebSocket-Version: 13" \
    7.     --http1.1 \
    8.     http://127.0.0.1:9080/ws
    1. HTTP/1.1 101 Switching Protocols

  3. Initiate the WebSocket request again in another terminal, the request will be rejected.

    1. HTTP/1.1 503 Service Temporarily Unavailable
    2. ···
    3. <html>
    4. <head><title>503 Service Temporarily Unavailable</title></head>
    5. <body>
    6. <center><h1>503 Service Temporarily Unavailable</h1></center>
    7. <hr><center>openresty</center>
    8. </body>
    9. </html>