Origin shield
An origin shield is one shared cache layer between the edge locations and the source. When one hot key expires at 40 edge locations, the source gets 40 fills without a shield and 1 fill with it. The edge locations keep their own copies.
See it on the board
The same traffic runs on two boards. The simulator measured both when this page was built.
| Measure | Goal | 40 locations fill from the source | One shield fills for all |
|---|---|---|---|
| CPU use | under 70% | 400% Fail | 10% Pass |
| p99 latency | under 150 ms | 72 ms Pass | 72 ms Pass |
| Monthly cost | 1,121 USD/mo | 1,121 USD/mo | |
| Error rate | 0% | 0% |
Key numbers
| Number | Value |
|---|---|
| Edge cache read, median | 0.1 ms |
| Edge to shield, same continent, best case | 20 ms |
| Edge to shield, same continent, worst case | 40 ms |
1,600 keys · hit 81% · mean 3.2 ms
How it works
A CDN has many edge locations, and each one has its own cache. When a hot key expires, every location misses and asks the source. Coalescing at each location merges the readers at that location. It cannot merge the requests from different locations. With 40 locations, the source still gets 40 fills for one key.
An origin shield adds one more cache layer. The edge locations ask the shield on a miss, and only the shield asks the source. The shield coalesces the 40 requests into 1 fill and sends the answer to all locations. The source does the work once.
The shield costs one extra hop on a cold miss. Place it close to the source, and the hop between an edge location and the shield is 20 to 40 ms on the same continent. A hit at the edge pays none of this. The shield is also one more part that can fail, so keep it simple.
The shield also cuts the traffic that leaves the source. Each object leaves once, not once for each location.
In the levels you keep all edge locations and add the shield so the source CPU stays low when a hot key expires.