In multi-tenant Kubernetes clusters, enforcing unified north–south ingress bandwidth limits is essential to ensure fair resource sharing. Although this sounds straightforward, Kubernetes currently lacks an effective solution.
Most CNI plugins only support per-Pod ingress bandwidth control. As workloads scale out with multiple replicas, it becomes impossible to enforce consistent limits at the tenant or application level. On the other hand, community LoadBalancer implementations do not provide ingress bandwidth management for LoadBalancer Services. As a result, operators often have to rely on external components outside the Kubernetes.
In this talk, we will present a lightweight, in-cluster approach built on Cilium CNI combined with Spiderpool. This design enables native bandwidth limiting for LoadBalancer Services, making it possible to achieve tenant-level ingress bandwidth management within Kubernetes, without adding external complexity.