Comparison
IngressvsRate limiting
Ingress
traffic from outside arrives at one front door with the certificate on it, and is routed inwards by hostname and path.
Traffic entering a cluster or network boundary from outside, and the configuration describing how it is routed once it arrives. It is where TLS termination, external DNS, WAF rules and public routing all live, so it is a shared, contended object across teams. It is also the natural chokepoint for rate limiting and authentication, which is why it accretes responsibilities until somebody calls it an API gateway.
Full entry →Rate limiting
you cap each client at a hundred requests a minute and start returning 429 once they go over.
Bounding how much a given caller can consume in a time window. It protects capacity, contains abuse, and stops one tenant from degrading everyone else. The limit needs to be per-identity and communicated in headers, or well-behaved clients cannot back off correctly and will simply retry into the wall.
Full entry →