global rate limiting policy ignored when defined for a TLS virtual host at the vhost level

[skriss]

What steps did you take and what happened:

1. Define a proxy like the following:

apiVersion: projectcontour.io/v1
kind: HTTPProxy
metadata:
  name: proxy-1
spec:
  routes:
  - services:
    - name: s1
      port: 80
  virtualhost:
    fqdn: contour.stevekriss.com
    tls:
      secretName: proxy-1-cert
    rateLimitPolicy:
      global:
        descriptors:
        - entries:
          - remoteAddress: {}

2. Configure a rate limit on remote address in the RLS.
3. curl contour.stevekriss.com repeatedly, observe the rate limit not taking effect

What did you expect to happen:

The rate limit should take effect.

Anything else you would like to add:

Global rate limit policies for non-TLS vhosts work fine. Also, global rate limit policies defined on individual routes for a TLS vhost work fine.

As such, a valid workaround is to define your global rate limit policy once for each route on your TLS vhost.

Environment:

• Contour version: 1.13