Support Global Rate Limiting with BackendTrafficPolicy

[ryanhristovski]

Description:

In certain cases, users need to apply multiple ordered rate limit rules to traffic flowing through Envoy Gateway. A common example is:

1. A global rate limit rule applied per IP at the Gateway level.
2. A more specific rate limit rule applied per IP per backend service at the Route level.

Currently, the behaviour for merging multiple BackendTrafficPolicies (BTPs) isn’t fully defined (see this issue for more context: #1934), and that ticket will be required before full functionality of shared rate limits. The ability to apply multiple BTPs in an ordered manner would provide finer control over rate-limiting behaviour.

Updated this issue from: #5194

Example of a global ratelimit applied at the gateway level:

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
metadata:
  name: global-ip-rule
spec:
  policyTargetReferences:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: my-gateway
  rateLimit:
    type: Global
    global:
      shared: true  # Applies across all routes
      rules:
      - clientSelectors:
        - sourceCIDR:
            type: "Distinct"
            value: "0.0.0.0/0"
        limit:
          requests: 10
          unit: Minute

example of a route-level rate limit at the httproute level:

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: BackendTrafficPolicy
metadata:
  name: per-service-per-ip-rule
spec:
  policyTargetReferences:
    - group: gateway.networking.k8s.io
      kind: HTTPRoute
      name: my-service-route
  rateLimit:
    type: Global
    global:
      shared: false # The default value for shared
      rules:
      - clientSelectors:
        - sourceCIDR:
            type: "Distinct"
            value: "0.0.0.0/0"
        limit:
          requests: 5
          unit: Minute

API PR: #5227