Milan arrives at the edge
Cloudflare's hardware engineering team has spent the better part of a year validating what will become the company's generation 11 server platform. As with previous cycles, the goal was straightforward: ship a platform every 12 to 18 months that improves requests per Watt, the metric Cloudflare uses to weigh performance against power consumption. The company operates servers in over 200 cities worldwide, so getting the design right before mass deployment matters.
The evaluation process ran alongside work on next-generation edge servers built on the Ampere Altra Arm architecture. This generation 11 platform, however, is x86. When the team compared Intel's latest "Ice Lake" Xeon processors against AMD's 3rd generation EPYC (code named Milan), the decision came down to power efficiency. Intel matched AMD on raw performance but drew several hundred watts more per server, making its performance per Watt unattractive. AMD and Ampere made the shortlist; Intel did not.
From 48 cores to 64
Cloudflare's generation 10 server used the AMD EPYC 7642, a 48-core part based on the 2nd generation Rome architecture. For generation 11, the team evaluated 48, 56 and 64-core Milan samples. A direct comparison between the two 48-core chips showed a performance boost of several percent for the newer architecture, which set expectations high for the higher core-count variants.
Testing followed Cloudflare's standard three-phase process. Because the company chose AMD again, the engineering validation test used generation 10 servers with only the new silicon and updated firmware swapped in. That phase surfaced a Linux kernel panic on boot, which was resolved with one of the ODMs. Synthetic benchmarks including Cloudflare's own cf_benchmark and an internal tool that applies load to the full software stack verified performance before moving on. Design validation test samples were then manufactured by ODMs with the new silicon, and once those passed muster, product validation test units were deployed in a production-like manner with the broader Cloudflare teams.
Performance per core
With 33% more cores than the 48-core EPYC 7642, the 64-core EPYC 7713 might be expected to deliver a similar jump in throughput. In practice, gains were more modest. The 64-core parts run lower base clock frequencies to stay within the same 225W power envelope, which explains the gap. Still, in production testing, the EPYC 7713 delivered around a 29% performance boost over the incumbent with comparable power and thermal characteristics. All processors in the comparison were tested at their highest supported configurable TDP.
| AMD EPYC 7642 | AMD EPYC 7643 | AMD EPYC 7663 | AMD EPYC 7713 | |
|---|---|---|---|---|
| Status | Incumbent | Candidate | Candidate | Candidate |
| Core Count | 48 | 48 | 56 | 64 |
| Thread Count | 96 | 96 | 112 | 128 |
| Base Clock | 2.3GHz | 2.3GHz | 2.0GHz | 2.0GHz |
| Max Boost Clock | 3.3GHz | 3.6GHz | 3.5GHz | 3.675GHz |
| Total L3 Cache | 256MB | 256MB | 256MB | 256MB |
| Default TDP | 225W | 225W | 240W | 225W |
| Configurable TDP | 240W | 240W | 240W | 240W |
Memory sizing and speed
Having settled on the processor, the team next determined how much memory the workload actually needs. Experiments with the EPYC 7713 compared 256GB, 384GB and 512GB configurations. Synthetic benchmarks such as STREAM ruled out any unexpectedly poor behaviour. Production workloads running on Cloudflare's standard monitoring stack, with Prometheus and Grafana collecting metrics, provided the empirical data.
Cloudflare's core HTTP server caches web assets in memory, so the tell-tale signs of insufficient memory are rising request latency and increased disk IO. If assets get ejected from memory prematurely, they have to be fetched from NVMe disks, which degrades performance. The 384GB configuration hit the sweet spot between the performance benefits of caching and the cost of unused capacity; 512GB did not justify the added expense. The team also switched from DDR4-2933 to DDR4-3200, which offered a several percent performance gain at a price that made the change worthwhile.
Previously: 256GB DDR4-2933
Now: 384GB DDR4-3200
Storage: Fewer Drives, More Capacity
For Gen 11, Cloudflare shifted from a 3x 960GB Samsung PM983 configuration to a 2x 1.92TB Samsung PM9A3 setup. This change delivers an extra 1TB of total storage while removing one physical drive, which saves roughly 6W of power. The move to 2TB drives also unlocks the higher performance ceiling of the larger capacity class.
Drive validation was handled through a combination of manufacturer datasheet review and hands-on testing with fio. To streamline the evaluation process, the team built an automation framework that restored drives to near-factory conditions, preconditioned them, ran sequential and random workloads, and analyzed the resulting bandwidth and latency data. Because SSD samples arrived at the test center in different months, the automated pipeline cut down the time spent on repetitive benchmarking and analysis.
The PM9A3 was selected after comparing the performance, latency, and endurance of various 2TB models. The measured results aligned with the published specifications. The new drives deliver roughly 1.5x to 2x improvements in read and write bandwidth compared to the previous generation, attributed to their PCIe 4.0 interface, more advanced SSD controllers, and upgraded NAND architecture.
Network: No Change Needed
The network interface remains the Mellanox ConnectX-4 dual-port 25G card. While higher-speed Ethernet was evaluated, it was not adopted. Cloudflare's architecture relies on commodity hardware and distributes load across all points of presence rather than funneling traffic through dedicated DDoS scrubbing centers. As a result, the existing 25G links continue to meet requirements, and the added cost of faster Ethernet was not justified.
Open Source Server Management
Cloudflare is moving its servers to OpenBMC, an open source baseboard management controller firmware. This follows the earlier deployment of Platform Secure Boot to establish hardware trust. With source code access, the team can now configure features like the fan PID controller, expose BIOS POST codes for logging, and manage networking ports and devices directly, without relying on vendor interpretation of feature requests.
The open source approach also strengthens security. Cloudflare can integrate preferred authentication modules, use specific software packages, stay current with the Linux kernel, and reduce exposure to various attack vectors. Because the production environment enforces kernel lockdown, flashing tools are restricted. Having access to the source code of those tools lets the team understand exactly what they need and assess whether they meet internal security standards. Upstream security issues can also be addressed without waiting on vendors.
Summary
The transition from Gen 9 to Gen 10 was a major architectural shift: dual-socket Intel to single-socket AMD, SATA to NVMe storage, and a multi-node chassis to a 1U form factor. Gen 11 was not expected to repeat that scale of change. After extensive testing of current chips and a review of Gen 10's production performance over more than a year, the Gen 11 design became a refinement of the existing foundation rather than a complete overhaul.
Despite the incremental nature of the update, Gen 11 serves approximately 29% more requests than Gen 10 without increasing power consumption, though performance varies by time of day and geographic location.
