I’ve configured a Spike Arrest policy (example: 3 requests per 1 minute) and wanted to understand the exact flow of how counters are handled and stored in the hybrid architecture.
Based on my understanding:
Message Processor (MP) enforces the policy.
Redis is used for caching/runtime coordination.
Cassandra is used as the persistent datastore.
Could you please confirm:
Whether the quota counters are persisted in Cassandra or Redis (or both)?
What is the role of Redis in rate limiting (is it L1/L2 cache or coordination layer)?
How does the request flow look when a client hits the API (Client → Router → MP → Redis → Cassandra)?
Is there any official Apigee doc or architecture diagram explaining this interaction for Hybrid?
In Apigee we have two types of rate limiting policies:
Quota: Used for contractual rate limiting over time.
Think counting calls by consumers in Minutes, Hours, and Days
Quotas are stored in Cassandra with rate synchronized by on the Quota policies configuration.
Spike Arrest: Used for (either or both) non-contractual consumer rate limiting and/or target protection. In either case, Spike is designed to help smooth traffic preventing redlining.
Think rough counting of calls in seconds or milliseconds
Spike Arrest counts in memory on the Message Processors
Spike Arrest will use Redis to coordinate counts when UseEffectiveCount is set
Note: A request’s flow never routes through Redis nor Cassandra. Calls flow: Client → Istio (routing) → MP → Target
This guide shows the connections between components within Hybrid, however it does not show the triggering events that drive each connection: Secure ports usage | Apigee | Google Cloud
For more information between these two policies please see: