blocking requests from a specific IP to an application in the AKS cluster

Question

Hello everybody!
I have an AKS cluster with my applications.
I recently noticed that an abnormally large number of requests are received from one IP address.
I would like to block this IP address for a certain time.
I want the blocking to occur automatically when a certain limit is reached, for example, more than 10,000 calls per minute from a unique IP
I am looking for a solution how to do this?
Tell me, someone faced such a task or knows a convenient solution

Answer 1

Hello @ProkhorovDmytro-0185

AKS supports different Ingress Controllers but unfortunately popular Azure Application Gateway do not have support of rate limiting.

You can use Nginx Ingress with annotation nginx.ingress.kubernetes.io/limit-rpm in AKS to apply rate limit instead of Azure Application Gateway.
There are more options to manage rate limit in Nginx Ingress
https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#rate-limiting

Here is an example of Nginx Ingress usage together with annotation nginx.ingress.kubernetes.io/limit-rpm

apiVersion: networking.k8s.io/v1  
kind: Ingress  
metadata:  
  name: ingress  
  annotations:  
    nginx.ingress.kubernetes.io/rewrite-target: /  
    nginx.ingress.kubernetes.io/limit-rpm: 1000  
spec:  
  rules:  
  - http:  
      paths:  
      - path: /testpath  
        pathType: Prefix  
        backend:  
          service:  
            name: test  
            port:  
              number: 80  

You may also limit rate using Web Application Firewall on Azure Front Door and put Azure Application Gateway or Nginx Ingress behind it.
You may configure a threshold on the number of web requests allowed from a client IP during a one-minute duration. This rule is distinct from an IP list-based allow/block custom rule that either allows all or blocks all request from a client IP. Rate limits can be combined with additional match conditions such as HTTP(S) parameter matches for granular rate control.

https://learn.microsoft.com/en-us/azure/web-application-firewall/afds/waf-front-door-rate-limit-powershell#create-a-custom-rate-limit-rule

Answer 2

Hello @Andriy Bilous

The annotation nginx.ingress.kubernetes.io/limit-rpm solution is a good way. Thanks