WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2026 Europe • Jul 10, 2026 • Session details

Rate-limiting using eBPF and Istio: How to protect your SaaS customers from themselves

Jan Mensch

How do you stop one noisy customer from crashing your entire shared infrastructure? Learn to combine eBPF and Istio for dual-layered rate limiting that ruthlessly drops runaway connections.

Pause
Mute Enter Fullscreen
#1 about 2 min

Introduction to ClickHouse cloud database architecture

An overview of ClickHouse as an analytical database and its cloud offering.

#2 about 2 min

SaaS network architecture and proxy routing challenges

How shared proxy routing handles client-to-database connections through a network load balancer.

#3 about 1 min

Exploring real-world customer infrastructure overload incidents

Examples of customers accidentally overwhelming shared infrastructure through load testing and misconfigurations.

#4 about 3 min

Defining goals for multi-tenant rate limiting

Why global rate limiters fail in shared proxy setups and the need for rapid connection resets.

#5 about 3 min

Injecting eBPF programs into the proxy network stack

Attaching eBPF programs directly to the proxy pod container network stack to avoid Cilium conflicts.

#6 about 2 min

Token bucket rate limiting logic in eBPF

Tracking and resetting excessive downstream requests dynamically to conserve server processing utilization.

#7 about 3 min

Live demonstration of packet capture interrupt handling

Running a minimal eBPF tool inside a container to capture incoming TCP handshake interactions.

#8 about 3 min

Identifying upstream connections using the proxy protocol

Utilizing proxy protocol encoding to preserve original client connection IPs behind cloud load balancers.

#9 about 3 min

Inferring disrupted targets via active network sampling

Correlating sampled traffic arrays to identify specific customer spammers without decrypting complete SNI headers.

#10 about 2 min

Limitations of relying on client-level eBPF limits

Why simultaneous flood bursts across thousands of client IP sources bypass downstream-level connection limits.

#11 about 2 min

Transitioning to Layer 7 rate limiting safeguards

Accepting TLS handshakes at layer seven to establish granular, multi-tenant application-aware traffic safeguards.

#12 about 3 min

Configuring dynamic proxy updates with Istio Pilot

Leveraging the Istio service mesh control plane to push Envoy rule updates immediately.

#13 about 3 min

Filtering upstream traffic with Envoy local limits

Deploying connection limit filters to arrest connection accumulation while capping sudden volume traffic bursts.

#14 about 2 min

Integrating eBPF limiters alongside Layer 7 proxies

Combining IP-focused eBPF mitigation with flexible Layer 7 structural limiters to shield downstream domains.

#15 about 3 min

Handling multi-connection metrics and gRPC integration

Addressing gRPC protocol constraints and interpreting complex memory map metrics within eBPF systems.

Matching moments

12:17 min

Managing edge cases and load balancing SSE

Rainer Stropek Rainer Stropek · LIVE

6:25 min

Platform security fundamentals using Istio service mesh

Thomas Südbröcker · LIVE

1:33 min

Practical use cases covering networking and performance profiling

Mohammed Aboullaite Mohammed Aboullaite · World Congress 2024

9:56 min

Final code walk-through and audience Q&A session

Germán Álvarez · LIVE

2:48 min

Working around API rate limits and model outages

Yan Cui Yan Cui · World Congress 2025

3:15 min

Addressing scaling limitations of proxies and service meshes

Duan Lightfoot Duan Lightfoot · World Congress 2023

More from World Congress 2026 Europe

Building the Nervous System of AI - Michael Kagan (NVIDIA) thumbnail
29:17
3 months ago

Building the Nervous System of AI - Michael Kagan (NVIDIA)

Michael Kagan, Sead Ahmetović

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote thumbnail
19:41
3 months ago

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote

Christian Heilmann

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend thumbnail
32:06
3 months ago

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend

David vonThenen

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes thumbnail
35:13
3 months ago

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes

Irina Branovic

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬 thumbnail
24:23
3 months ago

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬

Jeremy Murray

Angstfreude - AI and Corporate Culture - The Thrill and the Threat thumbnail
30:26
3 months ago

Angstfreude - AI and Corporate Culture - The Thrill and the Threat

Axel Ebert, Karin Krobath

Upcoming sessions on this topic

Open session

How We Cut Our API's p99 Latency from Minutes to Under a Second

  • Deepak Agrawal

    Atlassian

    Principal Software Engineer

Open session

Shipping MCP to Real Users: Scaling, Auth, and the PII Leak You Didn't See Coming

  • Hadar Geva

    Myop

    CTO & Co-founder

Open session

We Deleted Our Observability Stack and Rebuilt It with OTEL: 12 Engineers to 4 at 20K+ clusters

  • Yash Sharma

    DigitalOcean

    Developer Advocate

Open session

What I Got Wrong Shipping an MCP Server for Live Infrastructure

  • Pritesh Kiri

    Harness

    Developer Relations Engineer

Open session

Multi-Cloud Isn't a Project. It's a Side Effect.

  • Antonio Mendoza Pérez

    Temporal Technologies

    Staff Developer Success Engineer

  • Gaurav Thadani

    Temporal

    Staff Developer Success Engineer

Open session

React Under Fire: Rendering Performance for Streaming Agent UIs

  • Abhirupa Mitra

    Slack

    Senior Member of Technical Staff

Related videos

Scaling: from 0 to 20 million users thumbnail
28:12
World Congress 2023 • about 3 years ago

Scaling: from 0 to 20 million users

Josip Stuhli

The Hidden Costs of CPU Limits in Kubernetes thumbnail
27:49
World Congress 2026 Europe • 3 months ago

The Hidden Costs of CPU Limits in Kubernetes

Pavel Malyarevsky

Your Thread Pool Is Lying to You — Sizing Concurrency from Rate Limits and Latency, Not Guesswork thumbnail
25:41
World Congress 2026 North America • 16 days ago

Your Thread Pool Is Lying to You — Sizing Concurrency from Rate Limits and Latency, Not Guesswork

Ratul Ghosh

gRPC Load Balancing Deep Dive thumbnail
29:17
World Congress 2025 • about 1 year ago

gRPC Load Balancing Deep Dive

Max Hausner, Yves Fauser

IP Authentication: A Tale of Performance Pitfalls and Challenges in Prod thumbnail
18:34
World Congress 2025 • about 1 year ago

IP Authentication: A Tale of Performance Pitfalls and Challenges in Prod

Christoph Eicke

Real-Time Data Platforms at Trillion-Event Scale thumbnail
26:39
World Congress 2026 North America • 17 days ago

Real-Time Data Platforms at Trillion-Event Scale

Diptamay Sanyal

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.