Rate-limiting using eBPF and Istio: How to protect your SaaS customers from themselves

Do you offer a SaaS product? Is your entire infrastructure sitting behind a couple of reverse proxies that got overloaded because one customer decided to "stress test" your service? Then this talk is for you! This presentation covers rate limiting at ClickHouse Cloud, makers of the open-source database of the same name. We'll discuss how to cut off connections at L3 using eBPF before they overwhelm your proxies. You'll learn how we guess which customer is the (accidental) bad actor, even though our rate limiter never parses the TLS SNI header that would tell us which customer instance is being hit. You'll also learn why eBPF rate limiting isn't enough on its own, and why we use Istio as well.