Price a read in bytes processed and you are metering the wrong end of the pipe. A query that scans a whole table and returns one row was charged the same capacity cost as a query that reads one row, which Uber attributes to the way MySQL handles scanning and filtering [12]. The bytes visible at the metering point are the bytes that come back. The work is the scan. The error in that price therefore grows with the size of the table, and the tenant running the worst query is the one billed least.
The second defect is placement. Data is sharded across partitions, each one leader plus two followers coordinated via Raft [6], so three nodes per partition [18]. The partition is what runs out of headroom, not the cluster. For a stateless routing layer to shed on behalf of an overloaded partition, it would have to hold realtime health and load for thousands of partitions, and Uber says that tracking overhead undermined the scalability of the architecture [11].
The accounting had its own bill. Quota usage sat in a central Redis cache because the routing nodes keep no state [9], and every request paid a call to it [10]. At the aggregate rate the same post quotes, tens of millions of requests per second [3], that is a counter store fielding operations in the same order of magnitude as the database it protects [19]. Putting Redis in front of every request to improve availability is a hard sell at review.
A static quota is one number per tenant, fixed when someone asked for it. Uber reports the predictable result: frequent requests from stakeholders to adjust quotas, and quotas that were ineffective in multitenant environments [13]. The requirement it was meant to satisfy is fairness under a mix that moves, with workloads differing in traffic shape, latency profile and system impact [16]. One load manager here covers a transactional CRUD store and an append-only one [20]. A constant cannot express shape. It trips at the same count whether the burst clears in a second or a scan grinds for a minute, and it is the sustained case that turns into downstream timeouts and piled-up retries [17].
Whether the fix transfers depends on properties of your system rather than Uber's. Your storage nodes have to expose load locally and cheaply, or you have rebuilt the tracking problem one layer down. Your callers have to retry, because rejecting early only beats queueing if someone comes back. And your tenant count has to be high enough that hand-editing limits is a standing tax [13]. With three tenants and an engine that reports rows examined, a static quota is boring and debuggable, and boring is worth a lot at 3am.
What I cannot check is the signal. Uber says the load manager detects overload from multiple signals [15], and the next section of the post is titled Identifying the Right Signal for Overload [22], which is where the copy I have stops. Adaptive admission control is worth exactly what its signal is worth: choose one that lags and you shed after the damage; choose one that is noisy and you shed healthy traffic. The narrow, testable claim from the rest of it stands on its own. Admission control decided at a layer that cannot observe rows examined is pricing a proxy, and nothing bounds that proxy's error [12].
