Enable configuring Envoy private key provider through ProxyConfig by rveerama1 · Pull Request #2261 · istio/api

rveerama1 · 2022-03-03T12:00:39Z

Introduction

Since 1.20 Envoy has supported configuring private key providers over xDS. Also, the first in-tree private key provider (CryptoMB) was released in Envoy 1.20 contrib build (Ref PR: envoyproxy/envoy#17826 ).

The idea in CryptoMB private key provider is that incoming TLS handshakes’ RSA operations are accelerated using AVX-512 multi-buffer instructions. For more details, see this Intel whitepaper which contains some more information about the AVX-512 instructions and potential performance increase: https://www.intel.com/content/www/us/en/architecture-and-technology/crypto-acceleration-in-xeon-scalable-processors-wp.html.
An introductory presentation is available here : https://www.intel.com/content/www/us/en/developer/videos/accelerate-envoy-with-advanced-vector-extensions.html

The private key providers can be configured using SDS protocol: the private_key field in Envoy Secret is replaced with the private key provider configuration. For example,

tls_certificates:
   certificate_chain: { "filename": "/path/cert.pem" }
   private_key: { "filename": "/path/key.pem" }

could be replaced with:

 tls_certificates:
   certificate_chain: { "filename": "/path/cert.pem" }
   private_key_provider:
     provider_name: cryptomb
     typed_config:
       "@type": type.googleapis.com/envoy.extensions.private_key_providers.cryptomb.v3alpha.CryptoMbPrivateKeyMethodConfig
       private_key: { "filename": "/path/key.pem" }
       poll_delay: 0.1s

The problem is that private key providers are typically host-dependent: for example, CryptoMb provider requires a host with support for AVX-512 instruction set. Therefore, we propose an extension mechanism, which allows for dynamic configuration of private key providers.

To set the mesh wide defaults, configure the defaultConfig section of meshConfig. For example:

    meshConfig:
      defaultConfig:
        privateKeyProvider:
          cryptomb:
            pollDelay: 0.01s

This can also be configured on a per-workload basis by configuring the proxy.istio.io/config annotation on the pod.
For example:

    annotations:
      proxy.istio.io/config: |
        privateKeyProvider:
          cryptomb:
            pollDelay: 0.01s

istio-policy-bot · 2022-03-03T12:00:42Z

😊 Welcome @rveerama1! This is either your first contribution to the Istio api repo, or it's been
awhile since you've been here.

You can learn more about the Istio working groups, code of conduct, and contributing guidelines
by referring to Contributing to Istio.

Thanks for contributing!

Courtesy of your friendly welcome wagon.

istio-testing · 2022-03-03T12:00:55Z

Hi @rveerama1. Thanks for your PR.

I'm waiting for a istio member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

irisdingbj · 2022-03-04T00:55:59Z

/ok-to-test

mesh/v1alpha1/proxy.proto

irisdingbj · 2022-03-04T01:12:40Z

@howardjohn This is the API change part PR and the relevant istio change PR is istio/istio#37681
Please help to give a review for this, Thanks!

rveerama1 · 2022-03-04T09:20:58Z

Istio proxy relevant change is here: istio/proxy#3752

howardjohn

I am not a huge fan of exposing users to the raw underlying Envoy types -- especially since they are NOT passthrough and istio needs to have code to handle each type.

mesh/v1alpha1/proxy.proto

lambdai · 2022-03-07T18:31:31Z

The happy path is exciting.
How wide is the AVX-512? What if the the host doesn't offer AVX-512, e.g on a stale VM?

rveerama1 · 2022-03-08T10:42:43Z

What if the the host doesn't offer AVX-512, e.g on a stale VM?

This can be configured mesh wide and per-workload. In this case, user/admin has to configure per-workload basis and deploy it based on some label to that particular node which supports AVX-512.

ipuustin · 2022-03-08T15:40:02Z

The happy path is exciting. How wide is the AVX-512? What if the the host doesn't offer AVX-512, e.g on a stale VM?

The operations are https://en.wikipedia.org/wiki/AVX-512#IFMA calls, so the registers are 512 bits wide. Internally https://github.com/intel/ipp-crypto/tree/develop/sources/ippcp/crypto_mb library is called to perform the cryptographic operations.

irisdingbj · 2022-03-11T01:51:00Z

/test-all

irisdingbj · 2022-03-11T01:52:02Z

@howardjohn Can you please review the latest change? Thanks!

mesh/v1alpha1/proxy.proto

howardjohn

This LGTM other than the small comment.

I would like to see approval from some set of @shankgan @myidpt @jacob-delgado @costinm before merging though to make sure there is broader agreement (not all of them needed)

mesh/v1alpha1/proxy.proto

stale

jacob-delgado · 2022-03-15T03:18:25Z

We are trying to get rid of meshConfig and meshConfig.defaultConfig. I'm thinking this should this be moved to networking/v1beta1/proxy_config.proto and not be used inmeshConfig.defaultConfig or annotations. I'd like to see what the status is of ProxyConfig though before we commit a change.

Since the user cannot put node labels/tolerations and use affinity/anti-affinity on namespaces it needs to go on something that can be placed on a deployment, statefulset or daemonset. For this case ProxyConfig won't suffice and this is the right place to put it.

jacob-delgado · 2022-03-15T03:38:04Z

LGTM, but it'd be nice to get rid of the name field so that we don't have magic strings in the istio codebase.

Private key provider configuration will be provided by user in ProxyConfig configuration. This information will be used to send configuration to gateway/sidecar proxies.

rveerama1 · 2022-03-15T09:37:12Z

Thanks for the reviews @howardjohn @jacob-delgado, I have removed the 'name' part and updated the PR. PTAL.

rveerama1 requested review from ericvn, howardjohn, linsun, louiscryan and nrjpoddar as code owners March 3, 2022 12:00

istio-testing added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Mar 3, 2022

istio-testing added the needs-ok-to-test label Mar 3, 2022

rveerama1 mentioned this pull request Mar 3, 2022

Handle PrivateKeyProvider configuration istio/istio#37681

Merged

istio-testing added ok-to-test Set this label allow normal testing to take place for a PR not submitted by an Istio org member. and removed needs-ok-to-test labels Mar 4, 2022

irisdingbj reviewed Mar 4, 2022

View reviewed changes

mesh/v1alpha1/proxy.proto Outdated Show resolved Hide resolved

irisdingbj mentioned this pull request Mar 4, 2022

Proposal: enable configuring Envoy private key providers over xDS protocol from Istiod istio/istio#35809

Closed

rveerama1 mentioned this pull request Mar 4, 2022

Enable CryptoMB PrivateKeyProvider extension istio/proxy#3752

Merged

rveerama1 force-pushed the private-key-provider branch 3 times, most recently from 187bcaf to 75899d2 Compare March 4, 2022 10:41

howardjohn previously requested changes Mar 4, 2022

View reviewed changes

mesh/v1alpha1/proxy.proto Outdated Show resolved Hide resolved

rveerama1 force-pushed the private-key-provider branch from 75899d2 to 0dcfcf0 Compare March 10, 2022 13:02

zirain reviewed Mar 11, 2022

View reviewed changes

mesh/v1alpha1/proxy.proto Show resolved Hide resolved

howardjohn reviewed Mar 15, 2022

View reviewed changes

mesh/v1alpha1/proxy.proto Outdated Show resolved Hide resolved

rveerama1 added 4 commits March 15, 2022 10:32

Add PrivateKeyProvider protobuf in ProxyConfig

4d503d6

Private key provider configuration will be provided by user in ProxyConfig configuration. This information will be used to send configuration to gateway/sidecar proxies.

make gen

86df8e4

make proto-commit

632a6b3

add release notes

a472034

rveerama1 force-pushed the private-key-provider branch from 0dcfcf0 to a472034 Compare March 15, 2022 09:26

howardjohn approved these changes Mar 15, 2022

View reviewed changes

ericvn approved these changes Mar 15, 2022

View reviewed changes

istio-testing merged commit e5c6661 into istio:master Mar 15, 2022

rveerama1 mentioned this pull request Jun 10, 2022

Add rveerama1 to Istio member list istio/community#746

Merged

5 tasks

rveerama1 mentioned this pull request Nov 15, 2022

Enable configuring Envoy QAT private key provider #2565

Merged

Conversation

rveerama1 commented Mar 3, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

istio-policy-bot commented Mar 3, 2022

Uh oh!

istio-testing commented Mar 3, 2022

Uh oh!

irisdingbj commented Mar 4, 2022

Uh oh!

Uh oh!

irisdingbj commented Mar 4, 2022

Uh oh!

rveerama1 commented Mar 4, 2022

Uh oh!

howardjohn left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

lambdai commented Mar 7, 2022

Uh oh!

rveerama1 commented Mar 8, 2022

Uh oh!

ipuustin commented Mar 8, 2022

Uh oh!

irisdingbj commented Mar 11, 2022

Uh oh!

irisdingbj commented Mar 11, 2022

Uh oh!

Uh oh!

howardjohn left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jacob-delgado commented Mar 15, 2022

Uh oh!

jacob-delgado commented Mar 15, 2022

Uh oh!

rveerama1 commented Mar 15, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

10 participants

rveerama1 commented Mar 3, 2022 •

edited

Loading