Add Rate Limit variable condition

Author: pdabelf5

content/nic/configuration/policy-resource.md

@@ -175,8 +175,14 @@ condition:
 |Field | Description | Type | Required |
 | ---| ---| ---| --- |
 |``jwt`` | defines a JWT condition to rate limit against. | [ratelimit.condition.jwt](#ratelimitconditionjwt) | No |
-|``default`` | sets the rate limit in this policy to be the default if no conditions are met. In a group of policies with the same JWT condition, only one policy can be the default. | ``bool`` | No |
+|``variables`` | defines a Variable condition to rate limit against. | [ratelimit.condition.variables](#ratelimitconditionvariables) | No |
+|``default`` | sets the rate limit in this policy to be the default if no conditions are met. In a group of policies with the same condition, only one policy can be the default. | ``bool`` | No |
 {{% /table %}}
+{{< note >}}
+ 
+One condition of type `jwt` or `variables` is required.  Only ony condition per Policy is supported.
+
+{{< /note >}}
 
 The rate limit policy with condition is designed to be used in combination with one or more rate limit policies. For example, multiple rate limit policies with [RateLimit.Condition.JWT](#ratelimitconditionjwt) can be used to apply different tiers of rate limit based on the value of a JWT claim. For a practical example of tiered rate limiting by the value of a JWT claim, see the example in our [GitHub repository](https://github.com/nginx/kubernetes-ingress/tree/v{{< nic-version >}}/examples/custom-resources/rate-limit-tiered-jwt-claim/README.md).
 
@@ -213,6 +219,27 @@ The rate limit policy will only apply to requests that contain a JWT with the sp
 |``match`` | the value of the claim to match against. | ``string`` | Yes |
 {{% /table %}}
 
+### RateLimit.Condition.Variables
+
+RateLimit.Condition.Variables defines a condition for a rate limit by NGINX variable. For example, here we define a condition for a rate limit policy that only applies to requests with the request method with a value `GET`:
+
+```yaml
+variables:
+  - name: $request_method
+    match: GET
+```
+
+{{< note >}}
+Only one variable at a time is supported at present.
+{{< /note >}}
+
+{{% table %}}
+|Field | Description | Type | Required |
+| ---| ---| ---| --- |
+|``name`` | the name of the NGINX variable to be rate limit by. | ``string`` | Yes |
+|``match`` | the value of the NGINX variable to match against.  Values prefixed with the `~` character denote the following is a [regular expression](https://nginx.org/en/docs/http/ngx_http_map_module.html#map).  | ``string`` | Yes |
+{{% /table %}}
+
 ### APIKey
 
 The API Key auth policy configures NGINX to authorize client requests based on the presence of a valid API Key in a header or query param specified in the policy.