Skip to content

[26.1] User based throughput quotas#1596

Open
kbatuigas wants to merge 17 commits intov-WIP/26.1from
DOC-1792-document-feature-user-based-throughput-quotas
Open

[26.1] User based throughput quotas#1596
kbatuigas wants to merge 17 commits intov-WIP/26.1from
DOC-1792-document-feature-user-based-throughput-quotas

Conversation

@kbatuigas
Copy link
Contributor

@kbatuigas kbatuigas commented Mar 3, 2026

Description

This pull request introduces significant improvements to the documentation for configuring and understanding throughput quotas in Redpanda, with a focus on clarifying the distinction between user-based and client-based quotas, explaining quota precedence and tracking, and providing detailed, actionable configuration instructions.

A new conceptual guide has been added, and the practical guide has been expanded and reorganized for clarity and completeness.

Key documentation improvements:

Conceptual clarity and new guide

  • Added a new conceptual page about-throughput-quotas.adoc that explains the differences between user-based and client-based quotas, entity hierarchy, precedence rules, and quota tracking behavior. This guide helps users choose the right quota type for their use case and understand how Redpanda enforces quotas.
  • Updated the navigation (nav.adoc) to include the new conceptual guide for easy discovery.

Enhanced practical configuration instructions

  • Expanded manage-throughput.adoc with clear learning objectives, detailed descriptions of both user-based and client-based quotas, and step-by-step instructions for configuring, viewing, and deleting quotas using rpk. The guide now covers combined (user, client) quotas, default quotas, and best practices for multi-tenant environments. [1] [2]
  • Provided explicit instructions and examples for setting, viewing, and removing quotas for users, clients, and combinations thereof, including command-line examples for each scenario.

Improved quota monitoring and enforcement explanation

  • Clarified how quota enforcement and tracking works, including how unauthenticated connections are treated (user="" vs. user=<default>), and how throughput is tracked independently for each (user, client_id) pair. [1] [2]
  • Added details on how to monitor connections and quota usage, including new examples for listing connections by user and interpreting the output. [1] [2]

User experience and structure

  • Reorganized the documentation to separate conceptual understanding from configuration steps, improving readability and helping users find the information they need more quickly. [1] [2]
  • Updated section headings and added learning objectives for better guidance and discoverability.

References: [1] [2] [3] [4] [5] [6] [7]

Resolves https://redpandadata.atlassian.net/browse/
Review deadline: 9 Mar

Page previews

Manage Throughput
NEW: About Throughput Quotas

Checks

  • New feature
  • Content gap
  • Support Follow-up
  • Small fix (typos, links, copyedits, etc)

@kbatuigas kbatuigas requested a review from a team as a code owner March 3, 2026 03:56
@netlify
Copy link

netlify bot commented Mar 3, 2026

Deploy Preview for redpanda-docs-preview ready!

Name Link
🔨 Latest commit 162fa82
🔍 Latest deploy log https://app.netlify.com/projects/redpanda-docs-preview/deploys/69b0cdbbf7f53b000839fa7c
😎 Deploy Preview https://deploy-preview-1596--redpanda-docs-preview.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@coderabbitai
Copy link
Contributor

coderabbitai bot commented Mar 3, 2026

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2a355e0a-c8ff-405f-ad4d-5c2afcfa6b70

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch DOC-1792-document-feature-user-based-throughput-quotas

Comment @coderabbitai help to get the list of available commands and usage tips.

@kbatuigas kbatuigas requested a review from pgellert March 3, 2026 18:05

To identify which clients are actively connected and generating traffic, see <<view-connected-client-details>>.

// TODO: Verify the exact quota_rule label values for user-based quotas in v26.1.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@pgellert Would you mind confirming that the label values are as described here?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, good point, they do change. These are the set of values that are possible (a bunch of new rule values added, and the old cluster_ ones don't exist anymore): https://github.com/redpanda-data/redpanda/blob/a8aa17c80aaa60d6c4ac55e43c50eaf7da43372c/src/v/kafka/server/client_quota_translator.cc#L111-L133

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@pgellert according to our metrics docs generation tool + Claude Code, the label name also changed (redpanda_quota_rule, alongside redpanda_quota_type), I went ahead and added that in this doc but if you could please also double check, that would be helpful.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, the label names are indeed redpanda_quota_type and redpanda_quota_type. They have always been that, though, so that was a typo from earlier, rather than a change in 26.1.

Use user-based quotas when:

* You operate a multi-tenant environment, such as SaaS platforms or enterprises with departments.
* You require isolation between users or tenants, including for compliance requirements.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"* You require isolation between users or tenants, to avoid noisy neighbor issues."

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mattschumpert Updated this line, and also updated the intro to this doc: https://deploy-preview-1596--redpanda-docs-preview.netlify.app/current/manage/cluster-maintenance/about-throughput-quotas/

Redpanda uses throughput quotas to limit the rate of produce and consume requests from clients. Understanding how quotas work helps you prevent individual clients from disproportionately consuming resources and causing performance degradation for other clients (also known as the "noisy-neighbor" problem), and ensure fair resource sharing across users and applications.

How does this sound?

Copy link
Contributor

@pgellert pgellert left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm, thank you!


== Throughput control overview

Redpanda provides two types of throughput limits: broker-wide limits configured using cluster properties and client quotas configured using Kafka API.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe format these two as definition lists? Easier to consume quickly.


Redpanda provides two types of throughput limits: broker-wide limits configured using cluster properties and client quotas configured using Kafka API.

This page covers client quotas, which enable per-user and per-client rate limiting with fine-grained control through entity hierarchy and precedence rules. For information about broker-wide limits, see xref:manage:cluster-maintenance/manage-throughput.adoc#broker-wide-throughput-limits[Broker-wide throughput limits].
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This confused me: "This page"...we don't typically use that to describe the content, do we? I see that client quotas is a sub-topic within Quota entities, but there are also other topics covered here too, like user-based quotas.

Is there an issue here with heading hierarchy?

Comment on lines +228 to +231
* User-only quotas share across client_ids: When you configure a quota at the user level (for example, `/config/users/alice`) without specifying a `client_id` dimension, all connections from that user share a single quota bucket regardless of their `client_id`.
* Client-id-only quotas share across users: When you configure a quota at the `client_id` level (for example, `/config/clients/app-1`) without specifying a user dimension, all users connecting with that `client_id` share a single quota bucket.
* Combined quotas for per-(user, client_id) tracking: To get independent quota tracking per (user, client_id) combination, configure quotas that include both dimensions, such as `/config/users/<user>/clients/<client-id>` or `/config/users/<default>/clients/<default>`.
* Prefix-based quotas group clients: Client ID prefix quotas (for example, `/config/client-id-prefix/app-`) cause all clients whose `client_id` starts with that prefix to share a quota bucket.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wondering if each of these bullets applies to a specific level shown above. If so, you could use numbers to help readers quickly make the match/connection. I could be all wrong here, but if not, it sure would help me to quickly make the connection between the bullets here and the various levels above.


Then `alice` connecting with `client_id=app-1` and `alice` connecting with `client_id=app-2` share the same 10 MB/s limit. Their combined throughput cannot exceed 10 MB/s.

To give each of `alice`'s clients an independent 10 MB/s limit, configure:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
To give each of `alice`'s clients an independent 10 MB/s limit, configure:
To give each of `alice`'s` clients an independent 10 MB/s limit, configure:

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Was missing the closing delimiter, but is this what you intended?


This quota applies to all users who don't have a more specific quota configured. Each user is tracked independently: `alice` gets their own 10 MB/s bucket, `bob` gets their own 10 MB/s bucket, and so on.

Within each user, all `client_id` values share that user's bucket. `alice` connecting with `client_id=app-1` and `alice` connecting with `client_id=app-2` share the same 10 MB/s limit, while `bob`'s connections have a separate 10 MB/s limit.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Within each user, all `client_id` values share that user's bucket. `alice` connecting with `client_id=app-1` and `alice` connecting with `client_id=app-2` share the same 10 MB/s limit, while `bob`'s connections have a separate 10 MB/s limit.
Within each user, all `client_id` values share that user's bucket. `alice` connecting with `client_id=app-1` and `alice` connecting with `client_id=app-2` share the same 10 MB/s limit, while `bob`'s` connections have a separate 10 MB/s limit.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Again, not sure if this is what you intended--just adding a closing delimiter.


| `consumer_byte_rate`
| Limit throughput of fetch requests
This limits user `alice` to 2 MB/s for produce requests, regardless of which `client_id` they use.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

singular user, but plural pronoun. I see you are consistent with this, but not sure why.

rpk cluster quotas alter --add consumer_byte_rate=1000000 --name user=alice --name client-id=consumer-1
----

User `alice` using `client_id="consumer-1"` is limited to a 1 MB/s fetch rate. The same user with a different `client_id` would use a different quota (or fall back to less specific matches).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the significance of the double quotation marks here? Seems superfluous.

rpk cluster quotas alter --add producer_byte_rate=3000000 --name user=bob --name client-id-prefix=app1-
----

All clients used by user `bob` with `client_id` starting with "app1-" share a combined 3 MB/s quota.
Copy link
Contributor

@Feediver1 Feediver1 Mar 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why not app1-?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sometimes you use the delimiters, sometime the double quotation marks, sometimes both. Not going to mark every instance. Just be consistent, whatever you decide.


To identify which clients are actively connected and generating traffic, see <<view-connected-client-details>>.

Quota metrics use the `redpanda_quota_rule` label to identify which quota was applied to a request. The label distinguishes between different entity types (user, client, or combinations). See the label values in xref:reference:public-metrics-reference.adoc#redpanda-kafka-quotas-client-quota-throughput[].
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

link is not rendering
CC knows why!
The anchor exists but uses underscores, not hyphens. The xref uses redpanda-kafka-quotas-client-quota-throughput but the actual section heading is redpanda_kafka_quotas_client_quota_throughput.

Antora auto-generates anchors from section headings by replacing spaces with hyphens — but here the heading itself contains underscores (it's a metric name), so the anchor is also underscores.

The fix is to change the xref to match:

xref:reference:public-metrics-reference.adoc#redpanda_kafka_quotas_client_quota_throughput[]

Copy link
Contributor

@Feediver1 Feediver1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left several comments. Please fix all format/tagging errors.

Co-authored-by: Joyce Fee <102751339+Feediver1@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants