Edge Cache and CDN Platform  ·  View 02 of 29  ·  1 · Context and scope

High-Level Architecture

Five stages between a user and an origin, and the two systems that shape every stage without ever standing in it.

Editable source SVG draw.io All views
Reach Anycast prefixes 4 classes · BGP Katran L4 XDP · Maglev hash Terminate Envoy terminator TLS 1.3 · H2 · H3 Edge policy token · ceilings Serve Keyspec declared cache key Traffic Server edge RAM + NVMe Shield Traffic Server shield 4 sites · collapse Origin ceilings conns · req/s Origin Tenant origins ≤ 1.5% of bytes Off the request path Control plane config · purge · certs Telemetry logs · offload · cost access records Edge Cache and CDN Platform — High-Level Architecture Interface / broker Application we own Security / platform Decision point External / third party Data store event / async The control plane pushes signed bundles and purge events to every PoP; nothing in the last stage is on the request path. v 1.0 · owner Edge Architecture · date 2026-09

Decisions

  • The key is computed before the cache is consulted and from declared configuration only. It sits between termination and lookup because it is the one place where a correctness bug becomes a disclosure.
  • A shield tier stands between every PoP and every origin. Without it, origin load scales with the number of PoPs; with it, origin load scales with how often content changes.
  • Control plane and telemetry are off the request path. A PoP answers from files on its own disk and forgets its access records into a bounded buffer.

Numbers

  • Edge hit ratio of at least 96% by request and 92% by byte; origin offload of at least 98.5% by byte after shielding.
  • Cache-hit TTFB p50 15 ms, p95 45 ms, p99 120 ms. A shield hit adds at most 60 ms p95 for edges on the same continent as the shield.
  • Purge acknowledged by 99% of PoPs within 5 s p95; configuration at every PoP within 60 s p95 per ring.

Risks

  • Edges in Asia and South America are 150 to 200 ms from the nearest shield because no origin is there. Their shield hits miss the 60 ms budget by construction. The bet is that these are misses of misses, around 1 to 2% of their requests; a regional shield at SIN is the prepared alternative.