Pod Rate Limiting with Cilium – Deep Dive

I wrote a deep dive on Isovalent.com on Cilium implements traffic rate-limiting on Kubernetes Pods. It was a pretty lengthy process to write this up but I enjoyed reading up white papers on Quality of Service and Linux networking to be as accurate as possible.

I had recorded a brief demo on this topic a few weeks ago but if you want to learn more, read this!

A few more additional notes as I couldn’t quite fit it all in in the blog post:

  • There’s a lot of innovation happening in the networking space that starts – or at least is implemented first – in the Linux networking kernel stack. That’s something I didn’t appreciate until I started working on Cilium full time.
  • The rate-limit feature is interesting and researching it took me back to the times where I was either learning QoS when I was studying for my CCIE or when I was actually implementing it.
  • Networking in the Kubernetes world is similar but different to the old traditional Cisco world. What I find especially interesting here is, as I said in the first part of the post, we already had some Kubernetes-native mechanisms to address compute contention in Kubernetes but doing the same of networking was much harder.
  • Writing a blog post like this can be challenging because the readers can have very different background. How can I simultaneously address the DevOps engineer, the network architect, the Linux expert ? It’s just about impossible to find a common language… Just know that I tried to make it easy to read for everyone who might have a requirement to implement some kind of traffic policing/shaping on Kubernetes.
  • The feature I am describing enforces egress traffic limit, based on Bytes per seconds. This is different from Service Mesh traffic limit, which might be based on API call limitations for some example.
  • The blog post was inspired by a KubeCon session I saw in Valencia earlier this year and follows a similar storyline.
  • It’s not a feature you can just test on Kind unfortunately – you’re going to need some real HW for this.
  • I had lots of folks reviewing this blog post – thanks to all of them – so hopefully it’s accurate but if you spot any mistakes, just drop me a message.
  • The next deep dive blog post I have coming up on Isovalent.com is a deep dive on BBR on Cilium. That’s pretty cool and again it gave me up the opportunity to learn and do some research some bleeding edge tech.

Thanks for reading.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s