bug: Is it expected that per-consumer limit-conn is isolated per-route and per-pod?

[Thnnathat]

Current Behavior

Description

We noticed an inconsistency in how the limit-conn plugin handles consumer-level limits compared to the limit-req plugin.

When configuring the limit-conn plugin directly on a Consumer object:

1. Requests made by the same consumer to Route A and Route B do not share the same concurrency counter (cross-route leakage).
2. Requests made across multiple APISIX instances (replica pods) do not share the counter because different instances can end up using slightly different configuration versions internally, generating different Redis keys (cross-pod leakage).
3. Under the hood, the Redis/Valkey key is constructed using ctx.conf_version and ctx.conf_type (in apisix/plugins/limit-conn/init.lua):

   key = key .. ctx.conf_type .. ctx.conf_version

   This isolates the counter per-route and across instances (pods).

We recall that for limit-req, a similar issue was fixed in PR #13019 by using parent.resource_key to share the counter across routes and instances at the consumer level.

We would like to ask the community/maintainers:

• Is this behavior intended for limit-conn, or is it an inconsistency/oversight that should be aligned with how limit-req works to support shared counters across routes and multiple gateway instances?

Expected Behavior

No response

Error Logs

No response

Steps to Reproduce

1. Define a consumer with the limit-conn plugin activated (concurrency limit conn: 1, policy redis / redis-cluster).
2. Deploy APISIX with 2 replica pods.
3. Scenario A (Cross-route): Make concurrent requests to /route-a and /route-b using the same consumer credentials.
4. Scenario B (Cross-pod): Make concurrent requests targeting different pods (Pod A and Pod B) for the same consumer credentials.
5. Observation: Both requests succeed simultaneously. Checking Redis shows separate keys generated because the suffix (ctx.conf_version / ctx.conf_type) differs between the routes/pods.

Environment

• APISIX version: >= 3.16.0 (including 3.17.0)

[DanielWu-star]

Hi, I'd like to work on this issue.

From my understanding, the behavior of limit-conn at the
consumer level seems inconsistent with limit-req.

Would it make sense to align the Redis key generation with
the approach introduced in PR #13019 so that counters are
shared across routes and APISIX instances?

I'd be happy to submit a PR if this direction looks correct.