Catalog Details
CATEGORY
deploymentCREATED BY
UPDATED AT
May 04, 2024VERSION
1.0
What this pattern does:
Depending upon use cases, when an ingress gateway must handle a large number of incoming TLS and secured service-to-service connections through sidecar proxies, the load on Envoy increases. The potential performance depends on many factors, such as size of the cpuset on which Envoy is running, incoming traffic patterns, and key size. These factors can impact Envoy serving many new incoming TLS requests. To achieve performance improvements and accelerated handshakes, a new feature was introduced in Envoy 1.20 and Istio 1.14. It can be achieved with 3rd Gen Intel® Xeon® Scalable processors, the Intel® Integrated Performance Primitives (Intel® IPP) crypto library, CryptoMB Private Key Provider Method support in Envoy, and Private Key Provider configuration in Istio using ProxyConfig.\\\\\\\\\\\\\\
\\\\\\\\\\\\\\
Envoy uses BoringSSL as the default TLS library. BoringSSL supports setting private key methods for offloading asynchronous private key operations, and Envoy implements a private key provider framework to allow creation of Envoy extensions which handle TLS handshakes private key operations (signing and decryption) using the BoringSSL hooks.\\\\\\\\\\\\\\
\\\\\\\\\\\\\\
CryptoMB private key provider is an Envoy extension which handles BoringSSL TLS RSA operations using Intel AVX-512 multi-buffer acceleration. When a new handshake happens, BoringSSL invokes the private key provider to request the cryptographic operation, and then the control returns to Envoy. The RSA requests are gathered in a buffer. When the buffer is full or the timer expires, the private key provider invokes Intel AVX-512 processing of the buffer. When processing is done, Envoy is notified that the cryptographic operation is done and that it may continue with the handshakes.
Caveats and Consideration:
None
Compatibility:
Recent Discussions with "meshery" Tag
- May 03 | Kite Money Loan app Customer Care Number)::_8319053360)$( Call Nowmm
- May 03 | Kite Money Loan app Customer Care Number)::_8319053360)$( Call Now
- May 01 | WEBINAR: Making the CNCF Landscape interactive with Meshery
- Apr 24 | Meshery Development Meeting | April 24th 2024
- Mar 11 | [Help Wanted] A list of open DevOps-centric needs on Meshery projects
- Apr 14 | Unable to deploy meshery to minikube
- Apr 16 | Help needed for setup of meshery cli
- Apr 17 | Meshery Development Meeting | April 17th 2024
- Apr 12 | What exactly is this sistent design system project
- Nov 11 | Unable setup local Meshery development server