Local, Global and Hybrid Limits — Rate Limiting, Quotas & Abuse Protection

A central store adds latency and becomes a hotspot at very high rates. Options: local limits per instance (limit/N instances — fast but inaccurate when traffic is uneven or instances scale), global limits in Redis (accurate, adds a round trip), and hybrid approaches: local token buckets that sync periodically with a global counter, or local pre-filters that only consult the global store when close to the limit. Envoy's local + global rate limit services implement both.

Where limit state lives

Criterion	Local per instance	Global (central store)	Hybrid (local + periodic sync)
Latency	None	+1 network round trip	Mostly none
Accuracy	Low (depends on balancing)	High	Medium–high
Resilience	No dependency	Depends on store	Degrades gracefully
Best for	Overload protection	Billing/plan limits	Very high-RPS public APIs

# Envoy: cheap local limit per pod + global limit via rate limit service
http_filters:
  - name: envoy.filters.http.local_ratelimit
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
      stat_prefix: local
      token_bucket: { max_tokens: 500, tokens_per_fill: 500, fill_interval: 1s }
  - name: envoy.filters.http.ratelimit          # calls a global rate limit service (e.g. envoyproxy/ratelimit + Redis)
    typed_config:
      "@type": type.googleapis.com/envoy.extensions.filters.http.ratelimit.v3.RateLimit
      domain: public-api
      rate_limit_service: { grpc_service: { envoy_grpc: { cluster_name: ratelimit } }, transport_api_version: V3 }

Common pitfalls

Local limits with sticky sessions (one instance gets all of a client's traffic).
Global store without timeouts adding tail latency.
Forgetting limits change as instance count autoscales.

Key points

Local for overload, global for fairness/billing
Hybrid for very high RPS
Envoy supports both

Further reading: Envoy: Global rate limiting

Practice questions

Why are per-instance local limits inaccurate for per-client fairness?

Answer

A client's requests may be unevenly spread across instances, and the effective limit changes as instances scale up or down.

When is a local limit the right tool?

Answer

As a cheap last line of overload protection for each instance, independent of any shared store.