Currently the mapping is done in charts/api-gateway/config/ratelimiter_metrics.yaml
We may want to spin a copy of that config that applies only to the rest-gateway deployments, then tweak the label matches to get the cardinality we want.

Looking at the mappings in the existing ratelimiter_metrics.yaml file in the api-gateway chart, it looks like th erules it contains will not match the actual metrics we have. The mapping is based on matching keys that use "." as a separator, so "ratelimit.service.rate_limit.*.*.near_limit" would give the number of requests near the limit or a rate limit with a single descriptor key (the first * matches the limit domain). In the existing file, we have mappings with two and three starts (matching descriptors with one or two keys). But the descriptors we actually use all have mor ekeys, so they match no mapping rules.

Change #1199008 had a related patch set uploaded (by Daniel Kinzler; author: Daniel Kinzler):

[operations/deployment-charts@master] rest-gateway: Create metrics mapping for ratelimit service

https://gerrit.wikimedia.org/r/1199008

Change #1199008 merged by jenkins-bot:

[operations/deployment-charts@master] rest-gateway: Create metrics mapping for ratelimit service

https://gerrit.wikimedia.org/r/1199008

I merged the mapping for the rest-gateway and exported metrics look pretty good:

cgoubert@deploy2002:/srv/deployment-charts/helmfile.d/services/rest-gateway$ curl http://localhost:9090/metrics | grep service_ | grep -v '#'
[...]
ratelimit_service_rest_gateway_near_limit{policy="experiment-2025-shadow",unit="HOUR",user_class="anon"} 1
ratelimit_service_rest_gateway_over_limit{policy="experiment-2025-shadow",unit="HOUR",user_class="anon"} 10
ratelimit_service_rest_gateway_shadow_mode{policy="experiment-2025-shadow",unit="HOUR",user_class="anon"} 10
ratelimit_service_rest_gateway_total_hits{policy="experiment-2025-shadow",unit="HOUR",user_class="anon"} 13
ratelimit_service_rest_gateway_within_limit{policy="experiment-2025-shadow",unit="HOUR",user_class="anon"} 3

With a little bit of tweaking to the regex for api-gateway we now have correctly labeled metrics, and a (somewhat) useful rate limit graph