Add HTTPLocalRateLimitPolicy support

Cargo.lock

@@ -1325,7 +1325,7 @@ dependencies = [
 [[package]]
 name = "linkerd2-proxy-api"
 version = "0.14.0"
-source = "git+https://github.com/linkerd/linkerd2-proxy-api?rev=c5648ae2a1e405cc6b8aca20522356ebdf20f1ea#c5648ae2a1e405cc6b8aca20522356ebdf20f1ea"
+source = "git+https://github.com/linkerd/linkerd2-proxy-api.git?branch=alpeb/rate-limiting#1abdd2f69b4eb2c90f8325d6cddb58e77ef9cb05"
 dependencies = [
  "http",
  "ipnet",

Cargo.toml

@@ -14,5 +14,4 @@ members = [
 lto = "thin"
 
 [patch.crates-io]
-# TODO(Zahari): switch released version once TLS protocol support is out.
-linkerd2-proxy-api = { git = 'https://github.com/linkerd/linkerd2-proxy-api', rev = 'c5648ae2a1e405cc6b8aca20522356ebdf20f1ea' }
+linkerd2-proxy-api = { git = "https://github.com/linkerd/linkerd2-proxy-api.git", branch = "alpeb/rate-limiting" }

charts/linkerd-control-plane/templates/destination-rbac.yaml

@@ -180,6 +180,7 @@ webhooks:
     apiVersions: ["*"]
     resources:
     - authorizationpolicies
+    - httplocalratelimitpolicies
     - httproutes
     - networkauthentications
     - meshtlsauthentications
@@ -224,6 +225,7 @@ rules:
       - policy.linkerd.io
     resources:
       - authorizationpolicies
+      - httplocalratelimitpolicies
       - httproutes
       - meshtlsauthentications
       - networkauthentications

charts/linkerd-crds/templates/policy/http-local-ratelimit-policy.yaml

@@ -0,0 +1,122 @@
+---
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: httplocalratelimitpolicies.policy.linkerd.io
+  annotations:
+    {{ include "partials.annotations.created-by" . }}
+  labels:
+    helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    linkerd.io/control-plane-ns: {{.Release.Namespace}}
+spec:
+  group: policy.linkerd.io
+  names:
+    kind: HTTPLocalRateLimitPolicy
+    plural: httplocalratelimitpolicies
+    singular: httplocalratelimitpolicy
+    shortNames: [hlrlpolicy]
+  scope: Namespaced
+  versions:
+    - name: v1alpha1
+      served: true
+      storage: true
+      subresources:
+        status: {}
+      schema:
+        openAPIV3Schema:
+          type: object
+          required: [spec]
+          properties:
+            spec:
+              type: object
+              required: [targetRef]
+              properties:
+                targetRef:
+                  description: >-
+                    TargetRef references a resource to which the rate limit
+                    policy applies.
+                  type: object
+                  required: [kind, name]
+                  properties:
+                    group:
+                      description: >-
+                        Group is the group of the referent. When empty, the
+                        Kubernetes core API group is inferred.
+                      maxLength: 253
+                      pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                      type: string
+                    kind:
+                      description: Kind is the kind of the referent.
+                      maxLength: 63
+                      minLength: 1
+                      pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                      type: string
+                    name:
+                      description: Name is the name of the referent.
+                      maxLength: 253
+                      minLength: 1
+                      type: string
+                total:
+                  description: >-
+                    Overall rate-limit, which all traffic coming to this
+                    target should abide.
+                    If unset no overall limit is applied.
+                  type: object
+                  required: [requestsPerSecond]
+                  properties:
+                    requestsPerSecond:
+                      format: int64
+                      type: integer
+                identity:
+                  description: >-
+                    Fairness for individual identities; each separate client,
+                    grouped by identity, will have this rate-limit.
+                  type: object
+                  required: [requestsPerSecond]
+                  properties:
+                    requestsPerSecond:
+                      format: int64
+                      type: integer
+                overrides:
+                  description: Overrides for traffic from a specific client.
+                  type: array
+                  items:
+                    type: object
+                    required: [requestsPerSecond, clientRefs]
+                    properties:
+                      requestsPerSecond:
+                        format: int64
+                        type: integer
+                      clientRefs:
+                        type: array
+                        items:
+                          type: object
+                          required: [kind, name]
+                          properties:
+                            group:
+                              description: >-
+                                Group is the group of the referent. When empty, the
+                                Kubernetes core API group is inferred.
+                              maxLength: 253
+                              pattern: ^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+                              type: string
+                            kind:
+                              description: Kind is the kind of the referent.
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-zA-Z]([-a-zA-Z0-9]*[a-zA-Z0-9])?$
+                              type: string
+                            namespace:
+                              description: >-
+                                  Namespace is the namespace of the referent.
+                                  When unspecified (or empty string), this refers to the
+                                  local namespace of the Policy.
+                              maxLength: 63
+                              minLength: 1
+                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+                              type: string
+                            name:
+                              description: Name is the name of the referent.
+                              maxLength: 253
+                              minLength: 1
+                              type: string

cli/cmd/install.go

@@ -51,6 +51,7 @@ var (
 	TemplatesCrdFiles = []string{
 		"templates/policy/authorization-policy.yaml",
 		"templates/policy/egress-network.yaml",
+		"templates/policy/http-local-ratelimit-policy.yaml",
 		"templates/policy/httproute.yaml",
 		"templates/policy/meshtls-authentication.yaml",
 		"templates/policy/network-authentication.yaml",