Red Hat Connectivity Link

Plan Policy references

Understand the detailed references for each component of that you need to configure a Plan Policy.

PlanPolicy custom resource parameters

Understand the configuration parameters available for the PlanPolicy custom resource so that you can use the object effectively.

Table 31. PlanPolicy custom resource configuration fields definitions table
Parameter	Description
`spec.targetRef`	A reference to an existing Gateway API resource. A `PlanPolicy` object can target a Gateway, HTTPRoute, or GRPCRoute. The target resource must be in the same namespace as the `PlanPolicy` object.
`spec.plans`	An ordered list of plan definitions. Plans are evaluated in sequence and the first plan whose predicate evaluates to `true` is applied. More specific predicates must appear before more general ones.
`spec.plans.tier`	A unique string identifier for the plan tier, for example `gold`, `silver`, or `bronze`.
`spec.plans.predicate`	Specifies a Common Expression Language (CEL) expression evaluated against the authenticated request context.
`spec.plans.limits`	Specifies the rate limiting configuration for the tier.

Target an HTTPRoute in a PlanPolicy

When a PlanPolicy object targets an HTTPRoute custom resource (CR), you can use the following example to enforce the plan-based rate limits on all traffic flowing through that specific route.

Example enforcement of plan-based rate limits on HTTPRoute CR traffic

apiVersion: extensions.kuadrant.io/v1alpha1
kind: PlanPolicy
metadata:
  name: <sample_app>
  namespace: ${KUADRANT_DEVELOPER_NS}
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: HTTPRoute
    name: <sample_app>
  plans:
    - tier: gold
      predicate: |
        has(auth.identity) && auth.identity.metadata.annotations["secret.kuadrant.io/plan-id"] == "gold"
      limits:
        daily: 1000
        weekly: 5000
    - tier: silver
      predicate: |
        has(auth.identity) && auth.identity.metadata.annotations["secret.kuadrant.io/plan-id"] == "silver"
      limits:
        daily: 500
        weekly: 2000
    - tier: bronze
      predicate: |
        has(auth.identity) && auth.identity.metadata.annotations["secret.kuadrant.io/plan-id"] == "bronze"
      limits:
        daily: 100
        weekly: 500

Replace <sample_app> with the name of your application.
Replace ${KUADRANT_DEVELOPER_NS} with the namespace for your object.

Note

The Common Expression Language (CEL) expressions can be anything that applies to your use case. You can use an expression different from the secret.kuadrant.io/plan-id expression.

Target a GRPCRoute in a PlanPolicy

When a PlanPolicy object targets a GRPCRoute custom resource (CR), you can use the following example to enforce the plan-based rate limits on all traffic flowing through that specific route:

Example enforcement of plan-based rate limits on GRPCRoute CR traffic

apiVersion: extensions.kuadrant.io/v1alpha1
kind: PlanPolicy
metadata:
  name: <sample_app>
  namespace: ${KUADRANT_DEVELOPER_NS}
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: GRPCRoute
    name: <sample_app>
  plans:
    - tier: gold
      predicate: |
        has(auth.identity) && auth.identity.metadata.annotations["secret.kuadrant.io/plan-id"] == "gold"
      limits:
        daily: 1000
        weekly: 5000
    - tier: silver
      predicate: |
        has(auth.identity) && auth.identity.metadata.annotations["secret.kuadrant.io/plan-id"] == "silver"
      limits:
        daily: 500
        weekly: 2000
    - tier: bronze
      predicate: |
        has(auth.identity) && auth.identity.metadata.annotations["secret.kuadrant.io/plan-id"] == "bronze"
      limits:
        daily: 100
        weekly: 500

Replace <sample_app> with the name of your application.
Replace {KUADRANT_DEVELOPER_NS} with the namespace for your object.

Note	The Common Expression Language (CEL) expressions can be anything that applies to your use case. You can use an expression different from the `secret.kuadrant.io/plan-id` expression.

Target a Gateway object in a PlanPolicy

When a PlanPolicy object targets a Gateway custom resource (CR), Connectivity Link enforces the plan-based rate limits on all routes attached to that Gateway CR, as shown in the following example.

Example enforcement of plan-based rate limits on a Gateway object

apiVersion: extensions.kuadrant.io/v1alpha1
kind: PlanPolicy
metadata:
  name: <sample_app>
  namespace: ${KUADRANT_GATEWAY_NS}
spec:
  targetRef:
    group: gateway.networking.k8s.io
    kind: Gateway
    name: _<sample_app>
  plans:
    # ...

Replace <sample_app> with the name of the application.
Replace ${KUADRANT_GATEWAY_NS} with the namespace for the Gateway object

Plan predicates in PlanPolicies

Plan predicates are CEL expressions that determine which plan tier applies to a request. Connectivity Link evaluates predicates in the order they appear in spec.plans and selects the first plan whose predicate returns true.

The following patterns are supported:

Plan identified by an annotation on the API key Secret

predicate: |
  has(auth.identity) && auth.identity.metadata.annotations["secret.kuadrant.io/plan-id"] == "gold"

Plan identified by a JWT claim

predicate: |
  has(auth.identity) && auth.identity.sub == "premium-user"

Plan identified by multiple conditions

predicate: |
  has(auth.identity) &&
  auth.identity.metadata.annotations["secret.kuadrant.io/plan-id"] == "gold" &&
  auth.identity.metadata.labels["app"] == "my-app"

The has(auth.identity) check at the start of each predicate confirms that the request is authenticated before evaluating plan-specific conditions.

Plan limits for Plan Policy objects

The limits field in each plan definition sets the maximum number of requests allowed within each time window. All fields are optional. Specify only the windows relevant to your use case.

Field Description

Field	Description
`daily`	Maximum requests per calendar day.
`weekly`	Maximum requests per calendar week.
`monthly`	Maximum requests per calendar month.
`yearly`	Maximum requests per calendar year.
`custom`	One or more custom windows. Each entry requires a `limit` (integer) and a `window` (duration string, for example `"1h"` or `"1m"`).

daily

Maximum requests per calendar day.

weekly

Maximum requests per calendar week.

monthly

Maximum requests per calendar month.

yearly

Maximum requests per calendar year.

custom

One or more custom windows. Each entry requires a limit (integer) and a window (duration string, for example "1h" or "1m").

The following example shows a plan snippet using all available limit types:

#...
limits:
  daily: 1000
  weekly: 5000
  monthly: 20000
  yearly: 200000
  custom:
    - limit: 100
      window: "1h"
#...