mTLS Service Mesh Performance Tuning เพิ่มความเร็ว

mTLS Service Mesh Performance Tuning เพิ่มความเร็ว

mTLS (Mutual TLS) คือ TLS ที่ทั้ง client และ server ยืนยันตัวตนซึ่งกันและกันด้วย certificates เป็นมาตรฐาน security สำหรับ service-to-service communication ใน microservices Service Mesh เช่น Istio, Linkerd และ Consul Connect ใช้ mTLS เป็น default สำหรับ encrypt traffic ระหว่าง services แต่ mTLS เพิ่ม overhead ทั้ง CPU (TLS handshake, encryption) และ latency (extra round trips) บทความนี้อธิบายวิธี tune performance ของ mTLS ใน service mesh เพื่อลด latency และเพิ่ม throughput

mTLS Overhead Analysis

# mtls_overhead.py — Understanding mTLS overhead
import json

class MTLSOverhead:
    OVERHEAD_SOURCES = {
        "tls_handshake": {
            "name": "TLS Handshake",
            "description": "Initial connection setup — certificate exchange + key agreement",
            "latency_added": "1-5ms (TLS 1.2: 2 round trips, TLS 1.3: 1 round trip)",
            "mitigation": "Connection pooling, TLS session resumption, TLS 1.3",
        },
        "encryption": {
            "name": "Encryption/Decryption",
            "description": "ทุก packet ต้อง encrypt/decrypt — ใช้ CPU",
            "latency_added": "0.1-0.5ms per request (AES-NI hardware acceleration)",
            "mitigation": "AES-NI CPU support, avoid double encryption",
        },
        "cert_validation": {
            "name": "Certificate Validation",
            "description": "ตรวจสอบ certificate chain, expiry, revocation",
            "latency_added": "0.5-2ms (OCSP check อาจ 10-50ms ถ้า remote)",
            "mitigation": "OCSP stapling, short-lived certs (no revocation check)",
        },
        "sidecar_proxy": {
            "name": "Sidecar Proxy (Envoy/Linkerd-proxy)",
            "description": "Traffic ผ่าน proxy 2 ครั้ง (source sidecar → dest sidecar)",
            "latency_added": "1-3ms per hop (2 hops = 2-6ms total)",
            "mitigation": "eBPF (Cilium), ambient mesh (Istio ambient), proxy tuning",
        },
        "memory": {
            "name": "Memory Overhead",
            "description": "Sidecar proxy ใช้ RAM — Envoy ~50-100MB per pod",
            "mitigation": "Linkerd proxy (~20MB), Istio ambient mode (shared proxy)",
        },
    }

    def show_overhead(self):
        print("=== mTLS Overhead Sources ===\n")
        for key, oh in self.OVERHEAD_SOURCES.items():
            print(f"[{oh['name']}]")
            print(f"  {oh['description']}")
            print(f"  Latency: {oh['latency_added']}")
            print(f"  Fix: {oh['mitigation']}")
            print()

    def total_overhead(self):
        print("=== Total mTLS Overhead (typical) ===")
        print("  Without mesh: ~0ms (plain HTTP)")
        print("  With mesh (untuned): 5-15ms per request")
        print("  With mesh (tuned): 1-3ms per request")
        print("  Target: < 5ms overhead for P99")

overhead = MTLSOverhead()
overhead.show_overhead()
overhead.total_overhead()

Istio Performance Tuning

# istio_tuning.py — Istio mTLS performance tuning
import json

class IstioTuning:
    CONFIG = """
# === Istio Performance Tuning ===

# 1. Use TLS 1.3 (faster handshake)
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: STRICT
---
# DestinationRule with TLS 1.3
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: tls13-default
spec:
  host: "*.local"
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL
      # TLS 1.3 is default in newer Istio versions

# 2. Connection Pooling — reduce TLS handshakes
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: connection-pool-tuning
spec:
  host: payment-service
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
        connectTimeout: 5s
        tcpKeepalive:
          time: 7200s
          interval: 75s
      http:
        h2UpgradePolicy: DEFAULT
        maxRequestsPerConnection: 0  # unlimited (reuse connections)
        maxRetries: 3
        idleTimeout: 300s

# 3. Envoy proxy resource tuning
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
spec:
  meshConfig:
    defaultConfig:
      concurrency: 2  # Envoy worker threads (match CPU cores)
      holdApplicationUntilProxyStarts: true
  values:
    global:
      proxy:
        resources:
          requests:
            cpu: 100m
            memory: 128Mi
          limits:
            cpu: 500m
            memory: 256Mi

# 4. Protocol selection — use HTTP/2 for multiplexing
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: h2-upgrade
spec:
  host: api-service
  trafficPolicy:
    connectionPool:
      http:
        h2UpgradePolicy: UPGRADE  # Force HTTP/2
"""

    def show_config(self):
        print("=== Istio Tuning Config ===")
        print(self.CONFIG[:600])

    def tuning_checklist(self):
        print(f"\n=== Tuning Checklist ===")
        items = [
            "TLS 1.3 enabled (1-RTT handshake vs 2-RTT in TLS 1.2)",
            "Connection pooling configured (reduce handshake frequency)",
            "HTTP/2 enabled (multiplexing over single connection)",
            "Envoy concurrency = CPU cores allocated",
            "TCP keepalive enabled (prevent connection drops)",
            "Sidecar resource limits set appropriately",
            "Access logging reduced (async, sampling)",
            "Tracing sampling reduced (1-5% for production)",
        ]
        for item in items:
            print(f"  • {item}")

istio = IstioTuning()
istio.show_config()
istio.tuning_checklist()

Python Benchmark Tool

# benchmark.py — mTLS performance benchmark
import json

class MTLSBenchmark:
    CODE = """
# mtls_benchmark.py — Benchmark mTLS overhead in service mesh
import asyncio
import aiohttp
import time
import statistics
import json
from dataclasses import dataclass
from typing import List

@dataclass
class BenchmarkResult:
    endpoint: str
    total_requests: int
    successful: int
    failed: int
    avg_latency_ms: float
    p50_ms: float
    p95_ms: float
    p99_ms: float
    throughput_rps: float

class MeshBenchmark:
    def __init__(self):
        self.results = []
    
    async def benchmark_endpoint(self, url, num_requests=1000, 
                                  concurrency=50, timeout=10):
        '''Benchmark a single endpoint'''
        latencies = []
        errors = 0
        
        semaphore = asyncio.Semaphore(concurrency)
        
        async def single_request(session):
            nonlocal errors
            async with semaphore:
                start = time.perf_counter()
                try:
                    async with session.get(url, timeout=aiohttp.ClientTimeout(total=timeout)) as resp:
                        await resp.read()
                        if resp.status == 200:
                            latencies.append((time.perf_counter() - start) * 1000)
                        else:
                            errors += 1
                except:
                    errors += 1
        
        start_all = time.perf_counter()
        
        async with aiohttp.ClientSession() as session:
            tasks = [single_request(session) for _ in range(num_requests)]
            await asyncio.gather(*tasks)
        
        total_time = time.perf_counter() - start_all
        
        if latencies:
            sorted_lat = sorted(latencies)
            result = BenchmarkResult(
                endpoint=url,
                total_requests=num_requests,
                successful=len(latencies),
                failed=errors,
                avg_latency_ms=round(statistics.mean(latencies), 2),
                p50_ms=round(sorted_lat[len(sorted_lat)//2], 2),
                p95_ms=round(sorted_lat[int(len(sorted_lat)*0.95)], 2),
                p99_ms=round(sorted_lat[int(len(sorted_lat)*0.99)], 2),
                throughput_rps=round(len(latencies) / total_time, 1),
            )
            return result
        return None
    
    async def compare_mtls_overhead(self, service_url, direct_url):
        '''Compare latency with and without mTLS'''
        print("Benchmarking with mTLS (via mesh)...")
        mesh_result = await self.benchmark_endpoint(service_url)
        
        print("Benchmarking without mTLS (direct)...")
        direct_result = await self.benchmark_endpoint(direct_url)
        
        if mesh_result and direct_result:
            overhead = {
                'avg_overhead_ms': round(mesh_result.avg_latency_ms - direct_result.avg_latency_ms, 2),
                'p99_overhead_ms': round(mesh_result.p99_ms - direct_result.p99_ms, 2),
                'throughput_impact_pct': round(
                    (1 - mesh_result.throughput_rps / direct_result.throughput_rps) * 100, 1
                ),
            }
            return {'mesh': mesh_result, 'direct': direct_result, 'overhead': overhead}
        return None

# bench = MeshBenchmark()
# result = asyncio.run(bench.compare_mtls_overhead(
#     "http://payment-service:8080/health",
#     "http://payment-service.direct:8080/health"
# ))
"""

    def show_code(self):
        print("=== mTLS Benchmark Tool ===")
        print(self.CODE[:600])

bench = MTLSBenchmark()
bench.show_code()

Advanced Optimization Techniques

# advanced.py — Advanced mTLS optimization
import json

class AdvancedOptimization:
    TECHNIQUES = {
        "ebpf": {
            "name": "eBPF Acceleration (Cilium)",
            "description": "Bypass sidecar proxy สำหรับ L3/L4 — mTLS ใน kernel space",
            "benefit": "ลด latency 40-60%, ลด CPU 50%+",
            "trade_off": "L7 features จำกัด (no header routing)",
            "config": "Cilium with WireGuard encryption — native mTLS alternative",
        },
        "ambient_mesh": {
            "name": "Istio Ambient Mesh",
            "description": "Sidecar-less mesh — ztunnel (L4) + waypoint proxy (L7)",
            "benefit": "ลด memory 90% (ไม่ต้อง sidecar per pod), ลด latency",
            "trade_off": "ยังเป็น beta, L7 features ต้อง waypoint",
        },
        "session_resumption": {
            "name": "TLS Session Resumption",
            "description": "Reuse TLS session — skip full handshake สำหรับ reconnections",
            "benefit": "ลด handshake time 50%+ สำหรับ repeated connections",
            "config": "Envoy: max_session_keys, session_timeout configuration",
        },
        "cert_rotation": {
            "name": "Short-lived Certificates",
            "description": "ใช้ certs อายุ 24hr — ไม่ต้อง revocation check (OCSP)",
            "benefit": "ลด cert validation time, ปลอดภัยกว่า (compromise window สั้น)",
            "config": "Istio default: 24hr cert rotation via Citadel/istiod",
        },
        "protocol": {
            "name": "Protocol Optimization",
            "description": "ใช้ gRPC (HTTP/2) แทน REST (HTTP/1.1) — multiplexing",
            "benefit": "Single connection, header compression, binary protocol",
            "config": "Service mesh auto-detects gRPC — no extra config needed",
        },
    }

    def show_techniques(self):
        print("=== Advanced Optimization ===\n")
        for key, tech in self.TECHNIQUES.items():
            print(f"[{tech['name']}]")
            print(f"  {tech['description']}")
            print(f"  Benefit: {tech['benefit']}")
            print()

    def comparison_table(self):
        print("=== Mesh Comparison ===")
        meshes = [
            {"name": "Istio (sidecar)", "latency": "2-5ms", "memory": "~100MB/pod", "features": "Full L7"},
            {"name": "Istio (ambient)", "latency": "1-3ms", "memory": "~10MB/pod", "features": "L4 + L7 waypoint"},
            {"name": "Linkerd", "latency": "1-2ms", "memory": "~20MB/pod", "features": "L7 (simpler)"},
            {"name": "Cilium", "latency": "<1ms", "memory": "~0 (kernel)", "features": "L3/L4 + limited L7"},
        ]
        print(f"  {'Mesh':<20} {'Latency':<12} {'Memory':<15} {'Features'}")
        for m in meshes:
            print(f"  {m['name']:<20} {m['latency']:<12} {m['memory']:<15} {m['features']}")

adv = AdvancedOptimization()
adv.show_techniques()
adv.comparison_table()

Monitoring mTLS Performance

# monitoring.py — Monitor mTLS performance metrics
import json
import random

class MTLSMonitoring:
    METRICS = {
        "envoy_ssl_handshake": "จำนวน TLS handshakes — สูงไป = connection pooling ไม่ดี",
        "envoy_downstream_rq_time": "Request latency ฝั่ง client → proxy",
        "envoy_upstream_rq_time": "Request latency ฝั่ง proxy → service",
        "envoy_ssl_connection_error": "TLS connection errors — cert issues",
        "istio_request_duration_milliseconds": "Total request duration (P50, P95, P99)",
        "container_cpu_usage_seconds": "CPU usage ของ sidecar proxy",
        "container_memory_working_set_bytes": "Memory usage ของ sidecar proxy",
    }

    GRAFANA_QUERIES = """
# Prometheus queries for Grafana dashboard

# mTLS handshake rate
rate(envoy_ssl_handshake{mesh_id="mesh1"}[5m])

# Request latency P99
histogram_quantile(0.99,
  rate(istio_request_duration_milliseconds_bucket{
    reporter="destination"
  }[5m])
)

# Sidecar CPU usage
sum(rate(container_cpu_usage_seconds_total{
  container="istio-proxy"
}[5m])) by (pod)

# TLS errors
rate(envoy_ssl_connection_error{mesh_id="mesh1"}[5m])
"""

    def show_metrics(self):
        print("=== Key Metrics ===\n")
        for metric, desc in self.METRICS.items():
            print(f"  [{metric}]")
            print(f"    {desc}")

    def show_queries(self):
        print(f"\n=== Grafana Queries ===")
        print(self.GRAFANA_QUERIES[:400])

    def sample_dashboard(self):
        print(f"\n=== mTLS Performance Dashboard ===")
        print(f"  P50 latency: {random.uniform(1, 3):.1f}ms")
        print(f"  P95 latency: {random.uniform(3, 8):.1f}ms")
        print(f"  P99 latency: {random.uniform(5, 15):.1f}ms")
        print(f"  TLS handshakes/s: {random.randint(10, 200)}")
        print(f"  Sidecar CPU: {random.randint(20, 150)}m per pod")
        print(f"  Sidecar Memory: {random.randint(40, 120)}MB per pod")
        print(f"  TLS errors: {random.randint(0, 5)}/min")

mon = MTLSMonitoring()
mon.show_metrics()
mon.show_queries()
mon.sample_dashboard()

FAQ - คำถามที่พบบ่อย

Q: mTLS เพิ่ม latency เท่าไหร่?

A: Untuned: 5-15ms per request (P99) Tuned: 1-3ms per request (P99) eBPF (Cilium): < 1ms overhead สาเหตุหลัก: sidecar proxy hop (2x), TLS handshake (ถ้าไม่ pool connections) Tuning สำคัญ: connection pooling, TLS 1.3, HTTP/2, proper resource allocation

Q: ควรปิด mTLS เพื่อ performance ไหม?

A: ไม่แนะนำ — mTLS เป็น security baseline สำหรับ microservices ถ้า latency สำคัญมาก: ใช้ PERMISSIVE mode สำหรับ internal services ที่ไม่ sensitive หรือ: เปลี่ยนจาก sidecar → eBPF (Cilium) — mTLS ใน kernel space, latency ต่ำมาก Compliance: PCI DSS, SOC 2 ต้องการ encryption in transit — ปิดไม่ได้

Q: Istio กับ Linkerd อันไหนเร็วกว่า?

A: Linkerd: เร็วกว่า (Rust proxy ~20MB RAM, latency ต่ำกว่า) Istio: features มากกว่า (traffic management, fault injection, observability) แต่ Envoy proxy ใช้ resource มากกว่า Istio Ambient: ใกล้เคียง Linkerd performance — sidecar-less เลือก Linkerd: ถ้า simplicity + performance สำคัญ เลือก Istio: ถ้าต้องการ advanced traffic management + ecosystem

Q: Connection pooling ช่วยได้มากแค่ไหน?

A: มาก — TLS handshake คือ overhead หลัก (1-5ms per handshake) Connection pooling: reuse connections → skip handshake สำหรับ subsequent requests ลด latency: 30-50% สำหรับ services ที่ communicate บ่อย Config: maxRequestsPerConnection: 0 (unlimited), idleTimeout: 300s ข้อควรระวัง: connection ค้าง → ใช้ TCP keepalive + idle timeout ร่วมด้วย