Traffic control is used to limit the peak ingress and egress traffic for a specific virtual service, that is, to control the ingress and egress traffic for a VIP on the vNIC of a load balancer virtual machine, preventing any single VIP from consuming excessive bandwidth.
As shown in the figure, two virtual services are deployed on the same load balancer virtual machine, with VIP 1 and VIP 2, respectively. With peak bandwidths of 10 Mbps and 20 Mbps configured for the two virtual services respectively, the total peak bandwidth for client access to VIP 1 will not exceed 10 Mbps at any time, and the total peak bandwidth for access to VIP 2 will not exceed 20 Mbps.
When multiple virtual services share the same VIP, the peak bandwidth set in the most recent configuration takes effect, and the bandwidth is shared among all virtual services. The total peak bandwidth will not exceed the most recently configured value. For example, if virtual service 1 and virtual service 2 share the same VIP, and virtual service 1 is first configured with a peak bandwidth of 10 Mbps, and then a peak bandwidth of 20 Mbps is configured when setting up virtual service 2, the total peak bandwidth for client access to the VIP will not exceed 20 Mbps.
Traffic control is implemented using Linux TC, based on a qdisc-class-filter structure, as shown in the figure.
The implementation steps are as follows:
Create a qdisc queue. Linux controls traffic by queuing packets.
Create classes to define traffic rate-limiting policies. For example, create two rate-limiting policies: 10 Mbps and 20 Mbps.
Create filter rules to bind specified IP addresses and ports to classes, so that traffic control can take effect for specific virtual services.
In addition, because packet queuing rules are based on the egress direction, ingress traffic cannot be directly limited. Therefore, ingress traffic must first be redirected to an Intermediate Functional Block (IFB) device, a virtual device used for traffic control, and then qdisc queuing is applied to the IFB egress direction to achieve ingress traffic control for virtual services.
