<p>I've a strange behaviour when trying to do some load testing.</p>
<p><strong>Environment :</strong></p>
<ul>
<li>NGINX Ingress controller version: 0.44.0</li>
<li>Kubernetes version : 1.17.8</li>
<li>openidc.lua version : 1.7.4</li>
</ul>
<p>Here's the situation :</p>
<ul>
<li>The nginx ingress controller is deployed as daemonset, and due to the openidc module, I activated the sessionAffinity to ClientIP.</li>
<li>I have a simple stateless rest service deployed with a basic ingress which is tested for load (no sessionAffinity on that one).</li>
</ul>
<p>When launching load testing on the rest service without the sessionAffinity ClientIP, I reach far beyond 25 req/s (about 130 req/s before the service resources begin to crash, that's another thing).
But with the sessionAffinity activated, I only reach 25 req/s.</p>
<p>After some research, I found some interesting things, desribed like here : <a href="https://medium.com/titansoft-engineering/rate-limiting-for-your-kubernetes-applications-with-nginx-ingress-2e32721f7f57" rel="nofollow noreferrer">https://medium.com/titansoft-engineering/rate-limiting-for-your-kubernetes-applications-with-nginx-ingress-2e32721f7f57</a></p>
<p>So the formula, as the load test should always be served by the same nginx pod, should be : successful requests = period * rate + burst</p>
<p>So I did try to add the annotation nginx.ingress.kubernetes.io/limit-rps: &quot;100&quot; on my ingress, but no luck, still the same 25 req/s.</p>
<p>I also tried different combinations of the following annotations : <a href="https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#rate-limiting" rel="nofollow noreferrer">https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#rate-limiting</a>, but no luck either.</p>
<p>Am I missing something ?</p>

Aramsham
<p>In fact, it was more vicious than that.</p>
<p>It had nothing to do with the sessionAffinity, nor the rate limiting (in fact there's none by default, I didn't get it at first, the rate limit is only there if we want to limit for ddos purpose).</p>
<p>The prob was, I added in the configmap the options for modsecurity AND owasp rules.</p>
<p>And because of that, the request processing was so slow, it limited the number of request per seconds. When the sessionAffinity was not set, I didn't see the prob, as the req/s were fair, as distributed among all pods.</p>
<p>But with the sessionAffinity, so a load test on a single pod, the prob was clearly visible.</p>
<p>So I had to remove modsecurity and owasp, and it'll be the apps who will be responsible for that.</p>
<p>A little sad, as I wanted more central security on nginx so apps don't need to handle it, but not at that cost...</p>
<p>I'd be curious to understand what modsecurity is doing exatly to be so slow.</p>
