Ratelimit Domain should use Gateway class instead of Listener

[nezdolik]

Description: EG currently uses Listener as domain for Ratelimit service config. It should instead use Gateway class not to override RL config for a case when when multiple Envoy deployments with diff gateway classes use same RL instance.

Repro steps:

Include sample requests, environment, etc. All data and inputs required to reproduce the bug.

Note: If there are privacy concerns, sanitize the data prior to sharing.

Environment:

Include the environment like gateway version, envoy version and so on.

Logs:

Include the access logs and the Envoy logs.

[nezdolik]

cc @ryanhristovski

[arkodg]

@nezdolik i'm curious why this is happening, im trying to better understand the collision can you share a snippet of the config dump especially the portion of the RateLimit filter section where the domain is specified.

The IR Listener name has the Gateway name and namespace part of it https://github.com/envoyproxy/gateway/blob/d784c3237765aa258c3526b32765dd9c3abf6415/internal/gatewayapi/helpers.go#L360

and I dont think 1 Gateway can be mapped to multiple GatewayClass parents, so unsure whats happening here

[arkodg]

okay found the problem, the ratelimit runner is treating every subscribed message as SoTW https://github.com/envoyproxy/gateway/blob/d784c3237765aa258c3526b32765dd9c3abf6415/internal/globalratelimit/runner/runner.go#L124

but the publisher / gateway-api runner is sending individual messages per gatewayclass https://github.com/envoyproxy/gateway/blob/d784c3237765aa258c3526b32765dd9c3abf6415/internal/gatewayapi/runner/runner.go#L81

[arkodg]

the ratelimit runner will need to perform some additional accounting similar to what gateway-api runner does https://github.com/envoyproxy/gateway/blob/d784c3237765aa258c3526b32765dd9c3abf6415/internal/gatewayapi/runner/runner.go#L68

[sanposhiho]

/assign

[sanposhiho]

Opened a patch PR: https://github.com/envoyproxy/gateway/pull/3771