Rate-limiting using eBPF: How to protect your SaaS customers from themselves

Do you offer a SaaS product? Is your entire infrastructure protected behind a couple of reverse proxies, which got overloaded because one customer decided to "stress test your service" by opening tens of thousands of connections per second? Then this talk is for you! This presentation covers rate limiting at ClickHouse Cloud, makers of the open source database of the same name. We'll discuss how to cut off connections at L3 using eBPF before they overwhelm your proxies, and how to monitor rate limiting in production. You'll learn how we guess which customer is the (accidental) bad actor even though our rate limiting never parses the TLS SNI header that would tell us which customer instance is being hit.