InFlightReq

    To proactively prevent services from being overwhelmed with high load, the number of allowed simultaneous in-flight requests can be limited.

    Docker

    Kubernetes

    1. apiVersion: traefik.io/v1alpha1
    2. kind: Middleware
    3. metadata:
    4.   name: test-inflightreq
    5. spec:
    6.   inFlightReq:
    7.     amount: 10

    Consul Catalog

    1. # Limiting to 10 simultaneous connections
    2. - "traefik.http.middlewares.test-inflightreq.inflightreq.amount=10"

    Marathon

    1. "labels": {
    2.   "traefik.http.middlewares.test-inflightreq.inflightreq.amount": "10"
    3. }

    Rancher

    1. # Limiting to 10 simultaneous connections
    2. labels:
    3.   - "traefik.http.middlewares.test-inflightreq.inflightreq.amount=10"

    File (YAML)

    1. # Limiting to 10 simultaneous connections
    2. http:
    3.   middlewares:
    4.     test-inflightreq:
    5.       inFlightReq:
    6.         amount: 10

    File (TOML)

    1. # Limiting to 10 simultaneous connections
    2. [http.middlewares]
    3.   [http.middlewares.test-inflightreq.inFlightReq]
    4.     amount = 10

    Configuration Options

    The amount option defines the maximum amount of allowed simultaneous in-flight request. The middleware responds with HTTP 429 Too Many Requests if there are already amount requests in progress (based on the same sourceCriterion strategy).

    Docker

    1. labels:
    2.   - "traefik.http.middlewares.test-inflightreq.inflightreq.amount=10"

    Kubernetes

    1. apiVersion: traefik.io/v1alpha1
    2. kind: Middleware
    3. metadata:
    4.   name: test-inflightreq
    5. spec:
    6.   inFlightReq:
    7.     amount: 10

    Consul Catalog

    1. # Limiting to 10 simultaneous connections
    2. - "traefik.http.middlewares.test-inflightreq.inflightreq.amount=10"

    Marathon

    1. "labels": {
    2.   "traefik.http.middlewares.test-inflightreq.inflightreq.amount": "10"
    3. }

    Rancher

    1. # Limiting to 10 simultaneous connections
    2. labels:
    3.   - "traefik.http.middlewares.test-inflightreq.inflightreq.amount=10"

    File (YAML)

    1. # Limiting to 10 simultaneous connections
    2. http:
    3.   middlewares:
    4.     test-inflightreq:
    5.       inFlightReq:

    File (TOML)

    1. # Limiting to 10 simultaneous connections
    2. [http.middlewares]
    3.   [http.middlewares.test-inflightreq.inFlightReq]
    4.     amount = 10

    sourceCriterion

    The sourceCriterion option defines what criterion is used to group requests as originating from a common source. If several strategies are defined at the same time, an error will be raised. If none are set, the default is to use the requestHost.

    sourceCriterion.ipStrategy

    As a middleware, InFlightReq happens before the actual proxying to the backend takes place. In addition, the previous network hop only gets appended to X-Forwarded-For during the last stages of proxying, i.e. after it has already passed through the middleware. Therefore, during InFlightReq, as the previous network hop is not yet present in X-Forwarded-For, it cannot be used and/or relied upon.

    ipStrategy.depth

    The depth option tells Traefik to use the X-Forwarded-For header and select the IP located at the position (starting from the right).

    • If depth is greater than the total number of IPs in X-Forwarded-For, then the client IP is empty.
    • depth is ignored if its value is less than or equal to 0.

    Example of Depth & X-Forwarded-For

    If depth is set to 2, and the request X-Forwarded-For header is "10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1" then the “real” client IP is "10.0.0.1" (at depth 4) but the IP used as the criterion is "12.0.0.1" (depth=2).

    Docker

    Kubernetes

    1. apiVersion: traefik.io/v1alpha1
    2. kind: Middleware
    3. metadata:
    4.   name: test-inflightreq
    5. spec:
    6.   inFlightReq:
    7.     sourceCriterion:
    8.       ipStrategy:
    9.         depth: 2

    Consul Catalog

    1. - "traefik.http.middlewares.test-inflightreq.inflightreq.sourcecriterion.ipstrategy.depth=2"

    Marathon

    1. "labels": {
    2.   "traefik.http.middlewares.test-inflightreq.inflightreq.sourcecriterion.ipstrategy.depth": "2"
    3. }

    Rancher

    1. labels:
    2.   - "traefik.http.middlewares.test-inflightreq.inflightreq.sourcecriterion.ipstrategy.depth=2"

    File (YAML)

    1. http:
    2.   middlewares:
    3.     test-inflightreq:
    4.       inFlightReq:
    5.         sourceCriterion:
    6.           ipStrategy:
    7.             depth: 2

    File (TOML)

    1. [http.middlewares]
    2.   [http.middlewares.test-inflightreq.inflightreq]
    3.     [http.middlewares.test-inflightreq.inFlightReq.sourceCriterion.ipStrategy]
    4.       depth = 2
    ipStrategy.excludedIPs

    excludedIPs configures Traefik to scan the X-Forwarded-For header and select the first IP not in the list.

    If depth is specified, excludedIPs is ignored.

    Example of ExcludedIPs & X-Forwarded-For

    X-Forwarded-ForexcludedIPsclientIP
    “10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1”“12.0.0.1,13.0.0.1”“11.0.0.1”
    “10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1”“15.0.0.1,13.0.0.1”“12.0.0.1”
    “10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1”“10.0.0.1,13.0.0.1”“12.0.0.1”
    “10.0.0.1,11.0.0.1,12.0.0.1,13.0.0.1”“15.0.0.1,16.0.0.1”“13.0.0.1”
    “10.0.0.1,11.0.0.1”“10.0.0.1,11.0.0.1”“”

    Docker

    1. labels:
    2.   - "traefik.http.middlewares.test-inflightreq.inflightreq.sourcecriterion.ipstrategy.excludedips=127.0.0.1/32, 192.168.1.7"

    Kubernetes

    1. apiVersion: traefik.io/v1alpha1
    2. kind: Middleware
    3. metadata:
    4.   name: test-inflightreq
    5. spec:
    7.     sourceCriterion:
    8.       ipStrategy:
    9.         excludedIPs:
    10.         - 127.0.0.1/32
    11.         - 192.168.1.7

    Consul Catalog

    1. - "traefik.http.middlewares.test-inflightreq.inflightreq.sourcecriterion.ipstrategy.excludedips=127.0.0.1/32, 192.168.1.7"

    Marathon

    1. "labels": {
    2.   "traefik.http.middlewares.test-inflightreq.inflightreq.sourcecriterion.ipstrategy.excludedips": "127.0.0.1/32, 192.168.1.7"
    3. }
    1. labels:
    2.   - "traefik.http.middlewares.test-inflightreq.inflightreq.sourcecriterion.ipstrategy.excludedips=127.0.0.1/32, 192.168.1.7"

    File (YAML)

    1. http:
    2.   middlewares:
    3.     test-inflightreq:
    4.       inFlightReq:
    5.         sourceCriterion:
    6.             excludedIPs:
    7.               - "127.0.0.1/32"
    8.               - "192.168.1.7"

    File (TOML)

    1. [http.middlewares]
    2.   [http.middlewares.test-inflightreq.inflightreq]
    3.     [http.middlewares.test-inflightreq.inFlightReq.sourceCriterion.ipStrategy]
    4.       excludedIPs = ["127.0.0.1/32", "192.168.1.7"]

    sourceCriterion.requestHeaderName

    Name of the header used to group incoming requests.

    Docker

    Kubernetes

    1. apiVersion: traefik.io/v1alpha1
    2. kind: Middleware
    3. metadata:
    4.   name: test-inflightreq
    5. spec:
    6.   inFlightReq:
    7.     sourceCriterion:
    8.       requestHeaderName: username

    Consul Catalog

    1. - "traefik.http.middlewares.test-inflightreq.inflightreq.sourcecriterion.requestheadername=username"

    Marathon

    1. "labels": {
    2.   "traefik.http.middlewares.test-inflightreq.inflightreq.sourcecriterion.requestheadername": "username"
    3. }

    Rancher

    1. labels:
    2.   - "traefik.http.middlewares.test-inflightreq.inflightreq.sourcecriterion.requestheadername=username"

    File (YAML)

    1. http:
    2.   middlewares:
    3.     test-inflightreq:
    4.       inFlightReq:
    5.         sourceCriterion:
    6.           requestHeaderName: username

    File (TOML)

    1. [http.middlewares]
    2.   [http.middlewares.test-inflightreq.inflightreq]
    3.     [http.middlewares.test-inflightreq.inFlightReq.sourceCriterion]
    4.       requestHeaderName = "username"

    sourceCriterion.requestHost

    Whether to consider the request host as the source.

    Docker

    1. labels:
    2.   - "traefik.http.middlewares.test-inflightreq.inflightreq.sourcecriterion.requesthost=true"

    Kubernetes

    1. apiVersion: traefik.io/v1alpha1
    2. kind: Middleware
    3. metadata:
    4.   name: test-inflightreq
    5. spec:
    6.   inFlightReq:
    7.     sourceCriterion:
    8.       requestHost: true

    Cosul Catalog

    1. - "traefik.http.middlewares.test-inflightreq.inflightreq.sourcecriterion.requesthost=true"

    Marathon

    1. "labels": {
    2.   "traefik.http.middlewares.test-inflightreq.inflightreq.sourcecriterion.requesthost": "true"
    3. }

    Rancher

    1. labels:
    2.   - "traefik.http.middlewares.test-inflightreq.inflightreq.sourcecriterion.requesthost=true"

    File (YAML)

    1. http:
    2.   middlewares:
    3.     test-inflightreq:
    4.       inFlightReq:
    5.         sourceCriterion:
    6.           requestHost: true

    File (TOML)

    1. [http.middlewares]
    2.   [http.middlewares.test-inflightreq.inflightreq]
    3.     [http.middlewares.test-inflightreq.inFlightReq.sourceCriterion]