[fjvbn2003]

Commit Message:
docs: explain how route and virtual host rate limits combine

The rate limit filter page still points to the deprecated include_vh_rate_limits route field. Describe vh_rate_limits in RateLimitPerRoute instead, list its three values, and note that an empty rate_limits list on a route does not turn off the virtual host rate limits. Add an example that exempts one route with IGNORE.

Additional Description:
The page says "The route can optionally include the virtual host rate limit configurations" and links to RouteAction.include_vh_rate_limits, which is deprecated in favour of RateLimitPerRoute.vh_rate_limits. The page does not say what happens by default, and it does not mention vh_rate_limits at all. #15482 is a user asking how to use vh_rate_limits.

A common way to try to exempt one route is rate_limits: [] on that route. That has no effect: in proto3 an empty repeated field is the same as an unset one, and the filter (Filter::populateRateLimitDescriptors, VhRateLimitOptions::Override) uses the virtual host policy when route_entry->rateLimitPolicy().empty().

I checked this with Envoy 1.38.3 (0ebfcfe5…/1.38.3/Clean/RELEASE/BoringSSL). The virtual host has one generic_key rate limit, the filter has failure_mode_deny: true, and nothing listens on the rate limit service port, so a request gets 500 when a descriptor is sent and 200 when none is sent:

GET /empty/    (route rate_limits: [])                 -> HTTP 500  ratelimit.error 0 -> 1
GET /ignore/   (typed_per_filter_config IGNORE)        -> HTTP 200  ratelimit.error 1 -> 1
GET /own/      (route has its own rate_limits)         -> HTTP 500  ratelimit.error 1 -> 2
GET /default/  (no route config)                       -> HTTP 500  ratelimit.error 2 -> 3

config_dump shows the /empty/ route as {"match": {"prefix": "/empty/"}, "route": {"cluster": "echo"}}, so the empty list is dropped when the config is loaded.

Risk Level: Low (docs only)
Testing: Checked the behaviour above with Envoy 1.38.3 and checked that the code path is the same on main. I did not build the docs locally; the enum value references use the same form as other pages (for example envoy_v3_api_enum_value_extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder.UrlUnescapeSpec.ALL_CHARACTERS_EXCEPT_RESERVED).
Docs Changes: docs/root/configuration/http/http_filters/rate_limit_filter.rst
Release Notes: N/A
Platform Specific Features: N/A

This change was drafted with AI assistance and reviewed by me.

🤖 Generated with Claude Code

[repokitteh-read-only]

Docs for this Pull Request will be rendered here:

https://storage.googleapis.com/envoy-cncf-pr/48408/docs/index.html

The docs are (re-)rendered each time the CI Envoy/Prechecks (docs) job completes.

🐱

Caused by: #48408 was opened by fjvbn2003.

see: more, trace.

[repokitteh-read-only]

Hi @fjvbn2003, welcome and thank you for your contribution.

We will try to review your Pull Request as quickly as possible.

In the meantime, please take a look at the contribution guidelines if you have not done so already.

🐱

Caused by: #48408 was opened by fjvbn2003.

see: more, trace.