A SRE Guide to Content Delivery Networks and Edge Caching

A SRE Guide to Content Delivery Networks and Edge Caching

Content Delivery Networks (CDNs) serve as the first line of defense between public internet traffic and backend cloud infrastructure. However, viewing a CDN merely as a static file accelerator obscures its operational reality: edge caching layers act as stateful reverse proxies that enforce TLS termination, traffic shaping, request collapsing, and origin shielding.

Site Reliability Engineers manage CDN configurations to protect origin databases from thundering-herd traffic surges. By modeling cache key hashing functions, defining deterministic HTTP cache-control policies, and monitoring edge-to-origin latency differentials, teams ensure high performance while preventing cache poisoning. This guide explores CDN network architectures, caching protocols, and operational troubleshooting runbooks.

1. Edge Caching Mechanics and Mathematical Models

A CDN evaluates incoming requests against an internal cache key ((K)) constructed through a hashing function ((H)):

[K = H(\text{scheme}, \text{host}, \text{path}, \text{query parameters}, \text{selected headers})]

When query parameters or unnormalized headers are unintentionally included in the cache key, active keys multiply, triggering cache fragmentation.

Calculate edge caching efficiency using the Cache Hit Ratio:

[\text{CacheHitRatio} = \frac{\text{Cache Hits}}{\text{Cache Hits} + \text{Cache Misses}} \times 100]

A small regression in cache efficiency multiplies origin server load exponentially. For example, at (1,000\text{ req/s}), dropping from a (95%) hit ratio ((50\text{ origin req/s})) to a (70%) hit ratio ((300\text{ origin req/s})) increases backend request volume by (6\times).

Model total edge delivery and infrastructure expenditure ((C_{\text{total}})):

[C_{\text{total}} = C_{\text{CDN requests}} + C_{\text{CDN bandwidth}} + C_{\text{origin egress}} + C_{\text{origin compute}}]

2. Transport Protocol Comparison: HTTP/1.1 vs HTTP/2 vs HTTP/3

CDNs terminate client transport protocols at nearby Points of Presence (PoPs) to accelerate connection negotiation:

3. SRE CDN Performance Threshold Matrix

Establish operational thresholds to track edge and origin health:

4. Production CDN Header Strategies

Configure response headers to separate browser-level freshness from shared edge cache rules:

# Immutable fingerprinted assets (JavaScript/CSS bundles)
Cache-Control: public, max-age=31536000, immutable

# Dynamic HTML document with origin shield revalidation
Cache-Control: public, max-age=0, s-maxage=60, stale-while-revalidate=30

# Edge caching with stale fallback during origin downtime
Cache-Control: public, s-maxage=120, stale-if-error=300

# Strict privacy for authenticated endpoints (Never store at edge)
Cache-Control: private, no-store, no-cache

Inspect cache behavior and bypass mechanisms using CLI diagnostics:

# Inspect response headers, cache age, and server timings
curl -sS -D - -o /dev/null \
  -H 'Accept-Encoding: gzip, br' \
  https://pingzoapp.com/assets/app.js

# Measure repeated request latencies to identify cache HIT vs MISS variance
for i in {1..5}; do
  curl -sS -o /dev/null \
    -w 'Status: %{http_code} | TTFB: %{time_starttransfer}s | Total: %{time_total}s\n' \
    https://pingzoapp.com/
done

# Bypass CDN edge to test origin server directly
curl -sS -D - \
  --resolve pingzoapp.com:443:203.0.113.10 \
  https://pingzoapp.com/health

[!NOTE] SRE Error Budget Alert: Translate edge delivery failures into allowable downtime limits with our SLA Calculator. If DNS anycast routing directs users to suboptimal PoPs, verify global resolver paths using the DNS Lookup tool.

5. Troubleshooting CDN Degradation and Origin Overload

Follow this structured runbook when edge cache hit rates drop or origin latency spikes:

1. Isolate cache hit-ratio collapse: Check whether recent deployments introduced randomized query parameters or stripped s-maxage directives from API responses.
2. Inspect edge response headers: Look for X-Cache: MISS, CF-Cache-Status: DYNAMIC, or Age: 0 headers on endpoints expected to be cached.
3. Evaluate origin shielding and request collapsing: Verify that edge PoPs coalesce concurrent requests for expired objects instead of flooding origin servers with duplicate backend fetches.
4. Audit Vary header cardinality: Ensure that backends do not emit Vary: User-Agent or unbounded custom headers that fragment cache stores into thousands of isolated entries.
5. Validate purge execution status: Check if emergency cache invalidation jobs are stuck in queue backlogs across secondary regional PoPs.
6. Verify TLS handshake and ALPN negotiation: Run openssl s_client -connect pingzoapp.com:443 -alpn h2 to confirm edge certificates are valid and negotiating modern ciphers.
7. Enable stale-if-error directives: Protect users from backend outages by serving stale cached objects while origin microservices recover.
8. Activate origin rate-limiting bulkheads: Configure edge rate limiters (429 Too Many Requests) to shed excessive traffic before origin connection pools exhaust.
9. Validate recovery across global vantage points: Confirm that edge TTFB returns to baseline across North American, European, and Asian PoPs before marking the incident resolved.