envoyproxy/envoy
possible optimization: repetitive private key reads
Offen
#20.045 geöffnet am 18.02.2022
area/perfarea/tlsenhancementhelp wanted
Repository-Metriken
- Stars
- (27.997 Sterne)
- PR-Merge-Metriken
- (PR-Metriken ausstehend)
Beschreibung
Title: possible optimization: repetitive private key reads
Description: When investigating https://github.com/envoyproxy/envoy/issues/19774, I found another area that may be improved (possibly). Currently, for each cluster/listener, we do a full boringssl processing of the same key/cert pair (I think). This ends up being fairly expensive at scale. With a large number of clusters, startup time is decreased from 5.5s to 4.5s in my tests when using 2048 bit RSA keys vs ECDSA keys (since they are cheaper to process).
RSA:
ECDSA:
I know very little about boringssl or the lifecycles here, but my naive thought is that it could be read once and shared among each cluster
cc @lambdai