feat(rate-limit): configure shared meters from peering annotations

Accept named bits/packet meters, ordered ACL matches, and standard quantity
and duration formats. Export per-meter counters to Prometheus.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Daniel Noland <daniel@githedgehog.com>

Author: daniel-noland

Cargo.lock

@@ -204,6 +204,7 @@ netgauze-bgp-pkt = { version = "0.13.0", features = [] }
 netgauze-bmp-pkt = { version = "0.13.0", features = [] }
 nix = { version = "0.31.3", default-features = false, features = [] }
 num-derive = { version = "0.5.1", default-features = false, features = [] }
+num-bigint = { version = "0.5.1", default-features = false, features = ["std"] }
 num-traits = { version = "0.2.19", default-features = false, features = [] }
 once_cell = { version = "1.21.4", default-features = false, features = [] }
 ordermap = { version = "1.2.2", default-features = false, features = [] }

Cargo.toml

@@ -25,8 +25,13 @@ bolero = { workspace = true, optional = true, default-features = false, features
 chrono = { workspace = true, features = ["alloc", "std"] }
 derive_builder = { workspace = true, features = [] }
 ipnet = { workspace = true }
+k8s-openapi = { workspace = true, features = ["latest"] }
+num-bigint = { workspace = true }
+num-traits = { workspace = true }
 multi_index_map = { workspace = true, features = ["serde"] }
 ordermap = { workspace = true, features = ["std"] }
+serde = { workspace = true, features = ["derive", "std"] }
+serde_json = { workspace = true, features = ["std", "arbitrary_precision"] }
 thiserror = { workspace = true }
 tracing = { workspace = true, features = ["attributes"] }
 

config/Cargo.toml

@@ -197,7 +197,7 @@ impl TryFrom<(&SubnetMap, &SubnetMap, &GatewayAgentPeeringsAclRulesMatch)> for A
 /// # Errors
 ///
 /// Returns an error if both values are blank, or if a non-blank value matches neither VPC name.
-fn complete_from_to(
+pub(super) fn complete_from_to(
     rule_name: &str,
     from: &str,
     to: &str,

config/src/converters/k8s/config/acl.rs

@@ -15,6 +15,7 @@ pub mod gwgroups;
 pub mod interface;
 pub mod overlay;
 pub mod peering;
+pub mod ratelimit;
 pub mod tracecfg;
 pub mod underlay;
 pub mod vpc;

config/src/converters/k8s/config/mod.rs

@@ -12,7 +12,7 @@ use crate::external::overlay::Overlay;
 use crate::external::overlay::vpc::{Vpc, VpcTable};
 use crate::external::overlay::vpcpeering::{VpcPeering, VpcPeeringTable};
 
-fn extract_subnets(
+pub(super) fn extract_subnets(
     vpcs: &BTreeMap<String, GatewayAgentVpcs>,
 ) -> Result<VpcSubnetMap, FromK8sConversionError> {
     let mut vpc_subnets = VpcSubnetMap::new();
@@ -65,7 +65,8 @@ impl TryFrom<&GatewayAgentSpec> for Overlay {
     type Error = FromK8sConversionError;
 
     fn try_from(spec: &GatewayAgentSpec) -> Result<Self, Self::Error> {
-        match (spec.vpcs.as_ref(), spec.peerings.as_ref()) {
+        let rate_limits = super::ratelimit::rate_limits(spec)?;
+        let overlay = match (spec.vpcs.as_ref(), spec.peerings.as_ref()) {
             (None, None) => Ok(Overlay::new(VpcTable::new(), VpcPeeringTable::new())),
             (None, Some(peerings)) => Err(FromK8sConversionError::NotAllowed(format!(
                 "Found 0 vpcs but {} peerings",
@@ -83,7 +84,8 @@ impl TryFrom<&GatewayAgentSpec> for Overlay {
                 let overlay = Overlay::new(vpc_table, peering_table);
                 Ok(overlay)
             }
-        }
+        }?;
+        Ok(overlay.with_rate_limits(rate_limits))
     }
 }