specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Cilium
providerId: cilium
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - eBPF
  - Kubernetes
  - Networking
  - Observability
  - Security
  - Rate Limiting
description: Cilium APIs (cilium-agent REST API on the local Unix socket, Hubble gRPC Observer / Peer,
  Hubble Relay, Tetragon gRPC, and the Cilium Operator REST API) are local cluster APIs rather than
  multi-tenant SaaS endpoints. The project does not publish per-second rate limits — practical
  throughput is bounded by the agent / operator process, the underlying eBPF data path, the gRPC
  server settings on Hubble / Tetragon, and operator-defined ingress / authorization rules. Cilium
  itself can enforce L7 rate-limiting on application traffic via Envoy-based network policy — that
  is a workload-policy feature, not a self-imposed API limit.
notes: No published numeric rate-limit policy exists for the Cilium / Hubble / Tetragon APIs. Limits
  are operator-imposed at deployment time.
sources:
  - https://docs.cilium.io/
  - https://docs.cilium.io/en/stable/api/
  - https://docs.cilium.io/en/stable/observability/hubble/
  - https://tetragon.io/docs/
responseCodes:
  unauthorized: 401
  forbidden: 403
  serverError: 500
  gRPCUnavailable: 14
limits:
  - name: cilium-agent local API
    scope: node
    metric: varies
    limit: 'no built-in rate limit; bounded by node CPU / memory and Unix-socket throughput'
    notes: Served locally on each node; access is restricted by file-system permissions on the
      Unix-domain socket.
  - name: Hubble Observer gRPC
    scope: cluster
    metric: varies
    limit: 'gRPC server defaults; operator-tunable'
    notes: Per-stream concurrency is controlled by Hubble Relay configuration and the underlying
      gRPC server settings.
  - name: Tetragon gRPC
    scope: node
    metric: varies
    limit: 'gRPC server defaults; operator-tunable'
    notes: Tetragon does not impose an upstream rate limit; operators bound consumers via Kubernetes
      RBAC and gRPC server settings.
policies:
  - name: Backoff Strategy
    description: gRPC clients should retry transient unavailability with exponential backoff and
      jitter; honor any deadline / cancellation propagated by the server.
  - name: Local Access Model
    description: cilium-agent and the Cilium Operator API are local APIs intended for in-cluster /
      node-local use, secured by Unix-socket permissions and Kubernetes RBAC rather than per-second
      throttling.
  - name: Workload Rate Limiting
    description: Cilium Network Policy can enforce L7 rate limits on application traffic via
      Envoy-based filters — a workload-policy feature distinct from API rate limits.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com