envoyproxy / envoyproxy/gateway
Session resumption shared key
- Dominant language
- Go
- Stars
- 3k
- Forks
- 864
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 140
Description
*Description*:
Session resumption is available through
```
apiVersion: gateway.envoyproxy.io/v1alpha1
kind: ClientTrafficPolicy
metadata:
name: your-client-traffic-policy-name
namespace: your-namespace
spec:
targetRefs:
- group: gateway.networking.k8s.io
kind: Gateway
name: your-gateway-name
tls:
session:
resumption:
stateless: {}
```
This allows to resume a TLS session when a client connects back to the same gateway pod. As each Envoy pods generates its key by default, TLS sessions can't be resumed on another pod of the same gateway instance.
In a high traffic environment, TLS handshakes produce quite a heavy load on CPU and it would be efficient to share a key among all pods.
- A first level of implementation of this feature would be to use a k8s secret as a parameter to set the key. This secret should be reloaded any X period of time as it would be rotated elsewhere (by hand, by Hashicorp Vault, by ESO, by youNameIt etc)
- A higher level of implementation would be to set key generation and rotation (daily, or better, hourly) at gateway level. (see Envoy documentation link below about criticity of this key).
[optional *Relevant Links*:]
- https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto.html#extensions-transport-sockets-tls-v3-tlssessionticketkeys
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.