> Markdown version of [/events/world-congress-2026-europe/sessions/1251-rate-limiting-using](https://www.wearedevelopers.com/events/world-congress-2026-europe/sessions/1251-rate-limiting-using). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Rate-limiting using eBPF and Istio: How to protect your SaaS customers from themselves


- **Date:** Friday, Jul 10, 2026
- **Time:** 10:20–10:50 (30 min)
- **Room:** Stage 8 - powered by Red Hat
- **Event:** World Congress 2026 Europe

## Recording

[Watch recording](https://www.wearedevelopers.com/videos/100220-rate-limiting-using-ebpf-and-istio-how-to-protect-your-saas-customers-from-themselves)

## Description

Do you offer a SaaS product? Is your entire infrastructure sitting behind a couple of reverse proxies that got overloaded because one customer decided to "stress test" your service? Then this talk is for you!

This presentation covers rate limiting at ClickHouse Cloud, makers of the open-source database of the same name. We'll discuss how to cut off connections at L3 using eBPF before they overwhelm your proxies. You'll learn how we guess which customer is the (accidental) bad actor, even though our rate limiter never parses the TLS SNI header that would tell us which customer instance is being hit. You'll also learn why eBPF rate limiting isn't enough on its own, and why we use Istio as well.

## Speaker

### [Jan Mensch](https://www.wearedevelopers.com/@jan-mensch)

Software Developer at ClickHouse


## Related talks at this congress

- [The Hidden Costs of CPU Limits in Kubernetes](https://www.wearedevelopers.com/events/world-congress-2026-europe/sessions/1444-the-hidden-costs-of) — Pavel Malyarevsky
- [Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes](https://www.wearedevelopers.com/events/world-congress-2026-europe/sessions/1386-super-scaling-for) — Irina Branovic
- [There Is No Such Thing as a Fair DBaaS Benchmark](https://www.wearedevelopers.com/events/world-congress-2026-europe/sessions/1329-there-is-no-such) — Daniel Seybold
- [What If We've Been Scaling Stream Processing Wrong All Along?](https://www.wearedevelopers.com/events/world-congress-2026-europe/sessions/1313-what-if-we-ve-been) — Hartmut Armbruster