From f27caf69d6e6f14807883948233463d168e69ba5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Charles-Edouard=20Br=C3=A9t=C3=A9ch=C3=A9?= Date: Thu, 7 Nov 2024 16:54:49 +0100 Subject: [PATCH] docs: performance section (#202) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Charles-Edouard Brétéché --- .../{performance.md => performance/index.md} | 242 ++++++++---------- website/mkdocs.yaml | 3 +- 2 files changed, 111 insertions(+), 134 deletions(-) rename website/docs/{performance.md => performance/index.md} (62%) diff --git a/website/docs/performance.md b/website/docs/performance/index.md similarity index 62% rename from website/docs/performance.md rename to website/docs/performance/index.md index ff5e348..b5bf743 100644 --- a/website/docs/performance.md +++ b/website/docs/performance/index.md @@ -1,6 +1,7 @@ # Performance -This page offers guidance and best practices for benchmarking the performance of the kyverno-envoy-plugin, helping users understand the associated overhead. It outlines an example setup for conducting benchmarks, various benchmarking scenarios, and key metrics to capture for assessing the impact of the kyverno-envoy-plugin. +This page offers guidance and best practices for benchmarking the performance of the Kyverno Authz Server, helping users understand the associated overhead. +It outlines an example setup for conducting benchmarks, various benchmarking scenarios, and key metrics to capture for assessing the impact of the Kyverno Authz Server. ## Benchmark Setup @@ -12,9 +13,11 @@ The first component is a simple Go application that provides information of book ### Envoy -The second component is the Envoy proxy, which runs alongside the example application. The Envoy configuration defines an external authorization filter `envoy.ext_authz` for a gRPC authorization server. The config uses Envoy's in-built gRPC client to make external gRPC calls. +The second component is the Envoy proxy, which runs alongside the example application. The Envoy configuration defines an external authorization filter `envoy.ext_authz` for a gRPC authorization server. -``` +The config uses Envoy's in-built gRPC client to make external gRPC calls. + +```yaml static_resources: listeners: - address: @@ -89,56 +92,23 @@ layered_runtime: global_downstream_max_connections: 50000 ``` -### Kyverno-envoy-plugin +### Kyverno Authz Server -The third component is the `kyverno-envoy-plugin` itself, which is configured to load and enforce Kyverno policies on incoming requests. - -```yaml -containers: -- name: kyverno-envoy-plugin - image: sanskardevops/plugin:0.0.34 - imagePullPolicy: IfNotPresent - ports: - - containerPort: 8181 - - containerPort: 9000 - volumeMounts: - - readOnly: true - mountPath: /policies - name: policy-files - args: - - "serve" - - "--policy=/policies/policy.yaml" - - "--address=:9000" - - "--healthaddress=:8181" - livenessProbe: - httpGet: - path: /health - scheme: HTTP - port: 8181 - initialDelaySeconds: 5 - periodSeconds: 5 - readinessProbe: - httpGet: - path: /health - scheme: HTTP - port: 8181 - initialDelaySeconds: 5 - periodSeconds: 5 -``` +The third component is the Kyverno Authz Server itself, which is configured to load and enforce Kyverno policies on incoming requests. ## Benchmark Scenarios -The following scenarios should be tested to compare the performance of the `kyverno-envoy-plugin` under different conditions: +The following scenarios should be tested to compare the performance of the Kyverno Authz Server under different conditions: -1. **App Only**: Requests are sent directly to the application, without Envoy or the `kyverno-envoy-plugin`. -2. **App and Envoy**: Envoy is included in the request path, but the `kyverno-envoy-plugin` is not (i.e., Envoy External Authorization API is disabled). -3. **App, Envoy, and Kyverno (RBAC policy)**: Envoy External Authorization API is enabled, and a sample real-world RBAC policy is loaded into the `kyverno-envoy-plugin`. +1. **App Only**: Requests are sent directly to the application, without Envoy or the Kyverno Authz Server. +2. **App and Envoy**: Envoy is included in the request path, but the Kyverno Authz Server is not (i.e., Envoy External Authorization API is disabled). +3. **App, Envoy, and Kyverno**: Envoy External Authorization API is enabled, and a sample real-world policy is loaded into the Kyverno Authz Server. ## Load Testing with k6 To perform load testing, we'll use the k6 tool. Follow these steps: -1. **Install k6**: Install k6 on your machine by following the instructions on the official website: https://k6.io/docs/getting-started/installation/ +1. **Install k6**: Install [k6](https://k6.io/docs/getting-started/installation) on your machine by following the instructions on the official website. 2. **Write the k6 script**: Below is the example k6 script. @@ -182,7 +152,7 @@ export default function () { 3. **Run the k6 test**: Run the load test with the following command: -```shell +```bash $ k6 run -f - <