WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2026 Europe • Jul 10, 2026 • Session details

Rate-limiting using eBPF and Istio: How to protect your SaaS customers from themselves

Jan Mensch

How do you stop one noisy customer from crashing your entire shared infrastructure? Learn to combine eBPF and Istio for dual-layered rate limiting that ruthlessly drops runaway connections.

Pause
Mute Enter Fullscreen
#1 about 2 min

Introduction to ClickHouse cloud database architecture

An overview of ClickHouse as an analytical database and its cloud offering.

#2 about 2 min

SaaS network architecture and proxy routing challenges

How shared proxy routing handles client-to-database connections through a network load balancer.

#3 about 1 min

Exploring real-world customer infrastructure overload incidents

Examples of customers accidentally overwhelming shared infrastructure through load testing and misconfigurations.

#4 about 3 min

Defining goals for multi-tenant rate limiting

Why global rate limiters fail in shared proxy setups and the need for rapid connection resets.

#5 about 3 min

Injecting eBPF programs into the proxy network stack

Attaching eBPF programs directly to the proxy pod container network stack to avoid Cilium conflicts.

#6 about 2 min

Token bucket rate limiting logic in eBPF

Tracking and resetting excessive downstream requests dynamically to conserve server processing utilization.

#7 about 3 min

Live demonstration of packet capture interrupt handling

Running a minimal eBPF tool inside a container to capture incoming TCP handshake interactions.

#8 about 3 min

Identifying upstream connections using the proxy protocol

Utilizing proxy protocol encoding to preserve original client connection IPs behind cloud load balancers.

#9 about 3 min

Inferring disrupted targets via active network sampling

Correlating sampled traffic arrays to identify specific customer spammers without decrypting complete SNI headers.

#10 about 2 min

Limitations of relying on client-level eBPF limits

Why simultaneous flood bursts across thousands of client IP sources bypass downstream-level connection limits.

#11 about 2 min

Transitioning to Layer 7 rate limiting safeguards

Accepting TLS handshakes at layer seven to establish granular, multi-tenant application-aware traffic safeguards.

#12 about 3 min

Configuring dynamic proxy updates with Istio Pilot

Leveraging the Istio service mesh control plane to push Envoy rule updates immediately.

#13 about 3 min

Filtering upstream traffic with Envoy local limits

Deploying connection limit filters to arrest connection accumulation while capping sudden volume traffic bursts.

#14 about 2 min

Integrating eBPF limiters alongside Layer 7 proxies

Combining IP-focused eBPF mitigation with flexible Layer 7 structural limiters to shield downstream domains.

#15 about 3 min

Handling multi-connection metrics and gRPC integration

Addressing gRPC protocol constraints and interpreting complex memory map metrics within eBPF systems.

Matching moments

12:17 min

Managing edge cases and load balancing SSE

Rainer Stropek Rainer Stropek · LIVE

6:25 min

Platform security fundamentals using Istio service mesh

Thomas Südbröcker · LIVE

1:33 min

Practical use cases covering networking and performance profiling

Mohammed Aboullaite Mohammed Aboullaite · WWC 2024

9:56 min

Final code walk-through and audience Q&A session

Germán Álvarez · LIVE

2:48 min

Working around API rate limits and model outages

Yan Cui Yan Cui · WWC 2025

3:15 min

Addressing scaling limitations of proxies and service meshes

Duan Lightfoot Duan Lightfoot · WWC 2023

More from World Congress 2026 Europe

Building the Nervous System of AI - Michael Kagan (NVIDIA) thumbnail
29:17
about 1 month ago

Building the Nervous System of AI - Michael Kagan (NVIDIA)

Michael Kagan, Sead Ahmetović

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote thumbnail
19:41
about 1 month ago

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote

Christian Heilmann

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend thumbnail
32:06
about 1 month ago

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend

David vonThenen

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes thumbnail
35:13
about 1 month ago

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes

Irina Branovic

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬 thumbnail
24:23
about 1 month ago

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬

Jeremy Murray

Angstfreude - AI and Corporate Culture - The Thrill and the Threat thumbnail
30:26
about 1 month ago

Angstfreude - AI and Corporate Culture - The Thrill and the Threat

Axel Ebert, Karin Krobath

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Designing APIs That Survive AI Agents at Scale

Phani Pendurthi

Mastercard, Principal Software Engineer

Phani Pendurthi
Open session

World Congress 2026 North America

Boring Failover: Predictable Region Recovery Across 5,000 Microservices

Garvit Kataria, Sahil Sabharwal

Garvit Kataria
Sahil Sabharwal
Open session

World Congress 2026 North America

Microservice Cognitive Index for Deploy Diagnosis and Change Impact

Sachin Gupta

Member of Technical Staff 2 at eBay

Sachin Gupta
Open session

World Congress 2026 North America

Give the Agent a Budget, Not a Token

Sachin Malhotra

MTS @Anthropic

Sachin Malhotra
Open session

World Congress 2026 North America

AI Agents are Only as Smart as their Context: Building a Real-Time Context Engine at Intuit

Bharat Patel

Lead Software Engineer at Intuit

Bharat Patel
Open session

World Congress 2026 North America

public void saveMoney(AI): The Developer's Guide to Unit Economics

Hrushikesh Pokala

Senior Software Engineer Lead at Equifax

Hrushikesh Pokala

Related videos

Scaling: from 0 to 20 million users thumbnail
28:12
WWC 2023 • almost 3 years ago

Scaling: from 0 to 20 million users

Josip Stuhli

The Hidden Costs of CPU Limits in Kubernetes thumbnail
27:49
WWC Europe 2026 • about 1 month ago

The Hidden Costs of CPU Limits in Kubernetes

Pavel Malyarevsky

gRPC Load Balancing Deep Dive thumbnail
29:17
WWC 2025 • 12 months ago

gRPC Load Balancing Deep Dive

Max Hausner, Yves Fauser

IP Authentication: A Tale of Performance Pitfalls and Challenges in Prod thumbnail
18:34
WWC 2025 • 12 months ago

IP Authentication: A Tale of Performance Pitfalls and Challenges in Prod

Christoph Eicke

Unveiling the Magic: Scaling Large Language Models to Serve Millions thumbnail
31:25
WWC 2025 • 12 months ago

Unveiling the Magic: Scaling Large Language Models to Serve Millions

Patrick Koss

From 0 to 1.000.000: How to build a serverless raffle service for hyperscale thumbnail
30:03
WWC 2023 • almost 3 years ago

From 0 to 1.000.000: How to build a serverless raffle service for hyperscale

Marco Plaul, Martin Sakowski

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.