There's different setups I would want to test here, but considering that we will be using an Evnoy version less than 1.33 for a while, I propose we test a simple baseline first:

Envoy 1.26 (or whatever) with a central Redis instance, like we have in the Gateway for api.wikimedia.org. We could set that up to handle all API routes, but it doesn't really matter - for preliminary testing, we should use a dummy mackend anyway (e.g. an enginx container that serves static content) and map all routes to that.

In the initial rount, I'd want to test:

• Identifying the user based on the CentralAuth cookie (not secure, but good enough for testing)
• Hitting the endpoint with a lot of synthetic traffic (Locust?) to see how Redis holds up to 100k writes/sec

Change #1186954 had a related patch set uploaded (by Clément Goubert; author: Clément Goubert):

[operations/deployment-charts@master] api-gateway: Generalize ratelimit configuration

https://gerrit.wikimedia.org/r/1186954