> Markdown version of [/videos/100220-rate-limiting-using-ebpf-and-istio-how-to-protect-your-saas-customers-from-themselves?t=1723](https://www.wearedevelopers.com/videos/100220-rate-limiting-using-ebpf-and-istio-how-to-protect-your-saas-customers-from-themselves?t=1723). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Rate-limiting using eBPF and Istio: How to protect your SaaS customers from themselves

How do you stop one noisy customer from crashing your entire shared infrastructure? Learn to combine eBPF and Istio for dual-layered rate limiting that ruthlessly drops runaway connections.

- **Speakers:** [Jan Mensch](https://www.wearedevelopers.com/@jan-mensch)
- **Event:** World Congress 2026 Europe
- **Published:** July 10, 2026
- **Duration:** 31:32
- **URL:** https://www.wearedevelopers.com/videos/100220-rate-limiting-using-ebpf-and-istio-how-to-protect-your-saas-customers-from-themselves

## Summary

Operating a multi-tenant SaaS environment introduces the risk of the "noisy neighbor" problem, where a single customer’s misconfigured stress test or connection spam overwhelms shared infrastructure. In ClickHouse Cloud’s architecture, traffic flows through a Network Load Balancer (NLB) into a shared proxy layer. When a tenant inadvertently blasts thousands of new connections per second, it can cause out-of-memory (OOM) errors in the shared proxies, dropping connections for uninvolved customers. To protect multi-tenant integrity without relying on a strict global rate limiter that could trigger cascading failures, engineering teams require highly performant, dynamic rate limiting capable of stopping runaway traffic at both the network and application layers.

The first line of defense is an eBPF-based rate limiter operating at Layer 3/Layer 4, which hooks directly into the proxy pod's network stack via traffic control (TC). Using a token bucket algorithm to track incoming client IPs or VPC IDs, the eBPF program identifies aggressive downstream clients and sends an immediate TCP reset. By severing the connection before the TLS handshake or SNI header parsing occurs, this approach dramatically conserves compute resources. To maintain observability without Layer 7 context, allowed network traffic is continuously sampled into an internal logging database; this allows the team to cross-reference banned source IPs against historical traffic patterns to infer which client instance was actually targeted by the denial-of-service.

While eBPF efficiently neutralizes single high-volume offenders, it falls short against distributed attacks where thousands of distinct client IPs slowly creep up connection counts. To counter this, an Istio-managed strategy runs alongside eBPF to evaluate Layer 7 HTTP and native application traffic. Using Envoy's local rate limit and connection limit filters, the platform caps both sudden bursts and slow distributed connection exhaustion. Because it uses local proxy limits, the permitted volume intelligently increases as the system horizontally scales. Ultimately, relying on dual-layered networking controls provides comprehensive protection: eBPF limits resource waste from localized bursts, while context-aware Istio proxies enforce holistic ceilings on distributed traffic.

**Keywords:** ebpf network filtering, istio envoy proxies, token bucket algorithm, layer 7 rate limiting, tcp connection resets, tls handshake optimization, multitenant saas architecture, proxy protocol routing, noisy neighbor protection, sni header parsing, envoy filter chains, vpc traffic tracking, kubernetes proxy scaling, application connection limits

## Chapters

1. **Introduction to ClickHouse cloud database architecture** (00:00) — An overview of ClickHouse as an analytical database and its cloud offering.
1. **SaaS network architecture and proxy routing challenges** (01:47) — How shared proxy routing handles client-to-database connections through a network load balancer.
1. **Exploring real-world customer infrastructure overload incidents** (03:30) — Examples of customers accidentally overwhelming shared infrastructure through load testing and misconfigurations.
1. **Defining goals for multi-tenant rate limiting** (04:26) — Why global rate limiters fail in shared proxy setups and the need for rapid connection resets.
1. **Injecting eBPF programs into the proxy network stack** (06:43) — Attaching eBPF programs directly to the proxy pod container network stack to avoid Cilium conflicts.
1. **Token bucket rate limiting logic in eBPF** (09:28) — Tracking and resetting excessive downstream requests dynamically to conserve server processing utilization.
1. **Live demonstration of packet capture interrupt handling** (11:11) — Running a minimal eBPF tool inside a container to capture incoming TCP handshake interactions.
1. **Identifying upstream connections using the proxy protocol** (13:45) — Utilizing proxy protocol encoding to preserve original client connection IPs behind cloud load balancers.
1. **Inferring disrupted targets via active network sampling** (16:11) — Correlating sampled traffic arrays to identify specific customer spammers without decrypting complete SNI headers.
1. **Limitations of relying on client-level eBPF limits** (18:55) — Why simultaneous flood bursts across thousands of client IP sources bypass downstream-level connection limits.
1. **Transitioning to Layer 7 rate limiting safeguards** (20:06) — Accepting TLS handshakes at layer seven to establish granular, multi-tenant application-aware traffic safeguards.
1. **Configuring dynamic proxy updates with Istio Pilot** (21:50) — Leveraging the Istio service mesh control plane to push Envoy rule updates immediately.
1. **Filtering upstream traffic with Envoy local limits** (24:43) — Deploying connection limit filters to arrest connection accumulation while capping sudden volume traffic bursts.
1. **Integrating eBPF limiters alongside Layer 7 proxies** (27:36) — Combining IP-focused eBPF mitigation with flexible Layer 7 structural limiters to shield downstream domains.
1. **Handling multi-connection metrics and gRPC integration** (28:43) — Addressing gRPC protocol constraints and interpreting complex memory map metrics within eBPF systems.

## Related Moments

- [Managing edge cases and load balancing SSE](https://www.wearedevelopers.com/videos/905-leveraging-server-sent-events-sse-for-efficient-data-streaming-in-ui-development) (from "Leveraging Server-Sent Events (SSE) for Efficient Data Streaming in UI Development")
- [Platform security fundamentals using Istio service mesh](https://www.wearedevelopers.com/videos/123-get-started-with-securing-your-cloud-native-java-microservices-applications) (from "Get started with securing your cloud-native Java microservices applications")
- [Practical use cases covering networking and performance profiling](https://www.wearedevelopers.com/videos/1199-into-the-hive-of-ebpf) (from "Into the hive of eBPF!")
- [Final code walk-through and audience Q&A session](https://www.wearedevelopers.com/videos/831-creating-a-routing-app-with-google-maps-api-from-scratch) (from "Creating a routing app with Google Maps API from scratch")
- [Working around API rate limits and model outages](https://www.wearedevelopers.com/videos/1511-how-we-built-an-ai-powered-code-reviewer-in-80-hours) (from "How we built an AI-powered code reviewer in 80 hours")
- [Addressing scaling limitations of proxies and service meshes](https://www.wearedevelopers.com/videos/675-demystifying-application-networking-in-the-cloud) (from "Demystifying application networking in the cloud")

## Related Articles

- [Why Event-Driven Architecture Isn’t About Speed (and When You Actually Need It)](https://www.wearedevelopers.com/magazine/745-why-event-driven-architecture-isn-t-about-speed-and-when-you-actually-need-it)
- [Envoy Proxy: Documentary Overview](https://www.wearedevelopers.com/magazine/235-envoy-proxy-documentary-overview)
- [Stephan Gillich - Bringing AI Everywhere](https://www.wearedevelopers.com/magazine/489-stephan-gillich-bringing-ai-everywhere)
- [Making Data Warehouses Fast: A Developer’s Story](https://www.wearedevelopers.com/magazine/107-making-data-warehouses-fast-a-developer-s-story)

## Related Jobs

- [Senior Engineer, Infrastructure Platform](https://www.wearedevelopers.com/jobs/ext/328836-senior-engineer-infrastructure-platform) at **Intercom, Inc.**
- [Senior Backend Engineer (Java)](https://www.wearedevelopers.com/jobs/ext/19369-senior-backend-engineer-java) at **Bonial International GmbH**
- [Software Engineer, Platform Engineering (L2)](https://www.wearedevelopers.com/jobs/ext/1956829-software-engineer-platform-engineering-l2) at **Twilio**
- [Devops Engineer](https://www.wearedevelopers.com/jobs/ext/1940926-devops-engineer) at **Bitpanda**
- [Lead Cloud DevSecOps Engineer - Kubernetes](https://www.wearedevelopers.com/jobs/ext/1659167-lead-cloud-devsecops-engineer-kubernetes) at **BWI GmbH**
- [Staff Software Engineer](https://www.wearedevelopers.com/jobs/ext/1425755-staff-software-engineer) at **GitHub**