Kuma · Rate Limits

Kuma Rate Limits

Kuma's control-plane REST API has no vendor-imposed rate limit — it runs in-cluster (Kubernetes or Universal) and is bound by the operator's own deployment. Kuma does, however, ship a configurable data-plane RateLimit policy (MeshRateLimit / RateLimit) that consumers apply to mesh traffic between services. That is a feature of the mesh, not a quota imposed on the user.

Kuma Rate Limits is the machine-readable rate-limit profile for Kuma on the APIs.io network, conforming to the API Commons Rate Limits specification.

It captures 2 rate-limit definitions, measuring varies and requests_per_second.

The profile also includes 4 backoff/retry policies defined and response codes documented for throttled and serviceUnavailable.

Tagged areas include Rate Limiting, Service Mesh, and Open Source.

2 Limits Throttle: 429
Rate LimitingService MeshOpen Source

Limits

Control-plane REST API deployment
varies
no vendor-imposed limit; bound by control-plane resource limits
MeshRateLimit / RateLimit policy (data plane, user-configured) dataplane
requests_per_second
user-defined per policy; default unset

Policies

User-configured data-plane limits
Operators define MeshRateLimit and RateLimit policies on the control plane; Envoy proxies enforce them at the data-plane edge between services and at gateways.
429 response shape
When a configured rate limit fires, Envoy returns HTTP 429 with optional Retry-After; gRPC traffic returns RESOURCE_EXHAUSTED.
Control-plane sizing
Kuma scales horizontally; throughput on the REST API depends on the deployed control-plane replicas and the number of dataplanes connected.
Multi-zone replication
In multi-zone deployments, policy synchronization between Global and Zone control planes uses xDS / KDS; rate of policy churn affects control-plane resource usage but is not numerically capped.

Sources