在使用服务网格时，面对一些大规模集群，大家可能会担心：网格中授权策略内容过于庞大时，对网格代理的性能影响大吗？本文中我们就会给大家简单测试一下：不同情况下，授权策略中配置上万条IP时，对请求影响有多大？
首先说明结论：大多数情况下，对请求影响十分微小。
1. 初始环境介绍
- 网关：单副本。node：ecs.g6.xlarge，4c 16g。
resources: limits: cpu: '2' memory: 4G requests: cpu: 200m memory: 256Mi
- 测试客户端：Apple M1 Pro，16G，10核。
- 部署了一个httpbin应用在集群中。
初始化的流量规则配置：
apiVersion: networking.istio.io/v1beta1 kind: Gateway metadata: name: ingressgateway namespace: istio-system spec: selector: istio: ingressgateway servers: - hosts: - '*' port: name: http number: 80 protocol: HTTP --- apiVersion: networking.istio.io/v1beta1 kind: VirtualService metadata: name: ingressgateway namespace: default spec: gateways: - istio-system/ingressgateway hosts: - '*' http: - directResponse: body: string: test status: 333 match: - uri: prefix: / name: httpbin
2. 未配置授权策略时
网关上配置directResponse，网关直接返回，可以消除后端服务的影响。
hey -z 60s http://${网关IP} Summary: Total: 60.0374 secs Slowest: 0.1049 secs Fastest: 0.0242 secs Average: 0.0330 secs Requests/sec: 1514.3883 Total data: 363680 bytes Size/request: 4 bytes Response time histogram: 0.024 [1] | 0.032 [45351] |■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■ 0.040 [40733] |■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■ 0.048 [3568] |■■■ 0.056 [773] |■ 0.065 [260] | 0.073 [102] | 0.081 [73] | 0.089 [36] | 0.097 [19] | 0.105 [4] | Latency distribution: 10% in 0.0281 secs 25% in 0.0297 secs 50% in 0.0323 secs 75% in 0.0351 secs 90% in 0.0383 secs 95% in 0.0405 secs 99% in 0.0510 secs Details (average, fastest, slowest): DNS+dialup: 0.0000 secs, 0.0242 secs, 0.1049 secs DNS-lookup: 0.0000 secs, 0.0000 secs, 0.0000 secs req write: 0.0000 secs, 0.0000 secs, 0.0239 secs resp wait: 0.0329 secs, 0.0241 secs, 0.0916 secs resp read: 0.0001 secs, 0.0000 secs, 0.0214 secs Status code distribution: [333] 90920 responses
hey -z 60s http://${网关IP} Summary: Total: 60.0331 secs Slowest: 0.1317 secs Fastest: 0.0249 secs Average: 0.0323 secs Requests/sec: 1547.8289 Total data: 371684 bytes Size/request: 4 bytes Response time histogram: 0.025 [1] | 0.036 [78207] |■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■ 0.046 [13974] |■■■■■■■ 0.057 [578] | 0.068 [99] | 0.078 [17] | 0.089 [9] | 0.100 [11] | 0.110 [7] | 0.121 [12] | 0.132 [6] | Latency distribution: 10% in 0.0282 secs 25% in 0.0295 secs 50% in 0.0315 secs 75% in 0.0341 secs 90% in 0.0375 secs 95% in 0.0394 secs 99% in 0.0448 secs Details (average, fastest, slowest): DNS+dialup: 0.0000 secs, 0.0249 secs, 0.1317 secs DNS-lookup: 0.0000 secs, 0.0000 secs, 0.0000 secs req write: 0.0000 secs, 0.0000 secs, 0.0153 secs resp wait: 0.0321 secs, 0.0248 secs, 0.0805 secs resp read: 0.0001 secs, 0.0000 secs, 0.0265 secs Status code distribution: [333] 92921 responses
3. 配置一个20k条IP白名单的授权策略
IP白名单，本机IP不在白名单中，所以保证配置的所有IP都会被搜索到。之后请求会被拒绝，返回403。
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: test namespace: istio-system spec: action: ALLOW selector: matchLabels: istio: ingressgateway rules: - from: - source: ipBlocks: - 0.0.0.1 - 0.0.1.1 - 0.1.0.1 - 0.1.1.1 - 0.2.0.1 ......
测试结果：
hey -z 60s http://${网关IP} Summary: Total: 60.0372 secs Slowest: 0.1324 secs Fastest: 0.0249 secs Average: 0.0405 secs Requests/sec: 1235.2000 Total data: 1409002 bytes Size/request: 19 bytes Response time histogram: 0.025 [1] | 0.036 [28151] |■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■ 0.046 [27521] |■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■ 0.057 [15105] |■■■■■■■■■■■■■■■■■■■■■ 0.068 [2587] |■■■■ 0.079 [387] |■ 0.089 [217] | 0.100 [100] | 0.111 [37] | 0.122 [24] | 0.132 [28] | Latency distribution: 10% in 0.0304 secs 25% in 0.0332 secs 50% in 0.0385 secs 75% in 0.0463 secs 90% in 0.0523 secs 95% in 0.0565 secs 99% in 0.0688 secs Details (average, fastest, slowest): DNS+dialup: 0.0000 secs, 0.0249 secs, 0.1324 secs DNS-lookup: 0.0000 secs, 0.0000 secs, 0.0000 secs req write: 0.0000 secs, 0.0000 secs, 0.0196 secs resp wait: 0.0403 secs, 0.0248 secs, 0.1323 secs resp read: 0.0001 secs, 0.0000 secs, 0.0147 secs Status code distribution: [403] 74158 responses
hey -z 60s http://${网关IP} Summary: Total: 60.0327 secs Slowest: 0.1350 secs Fastest: 0.0253 secs Average: 0.0398 secs Requests/sec: 1254.8328 Total data: 1431289 bytes Size/request: 19 bytes Response time histogram: 0.025 [1] | 0.036 [31451] |■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■ 0.047 [29245] |■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■ 0.058 [12800] |■■■■■■■■■■■■■■■■ 0.069 [1670] |■■ 0.080 [64] | 0.091 [66] | 0.102 [11] | 0.113 [5] | 0.124 [14] | 0.135 [4] | Latency distribution: 10% in 0.0308 secs 25% in 0.0336 secs 50% in 0.0379 secs 75% in 0.0450 secs 90% in 0.0516 secs 95% in 0.0551 secs 99% in 0.0619 secs Details (average, fastest, slowest): DNS+dialup: 0.0000 secs, 0.0253 secs, 0.1350 secs DNS-lookup: 0.0000 secs, 0.0000 secs, 0.0000 secs req write: 0.0000 secs, 0.0000 secs, 0.0263 secs resp wait: 0.0397 secs, 0.0253 secs, 0.0905 secs resp read: 0.0001 secs, 0.0000 secs, 0.0227 secs Status code distribution: [403] 75331 responses
hey -z 60s http://${网关IP} Summary: Total: 60.0349 secs Slowest: 0.1495 secs Fastest: 0.0254 secs Average: 0.0392 secs Requests/sec: 1274.8926 Total data: 1454222 bytes Size/request: 19 bytes Response time histogram: 0.025 [1] | 0.038 [39207] |■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■ 0.050 [29507] |■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■ 0.063 [7066] |■■■■■■■ 0.075 [656] |■ 0.087 [57] | 0.100 [12] | 0.112 [8] | 0.125 [13] | 0.137 [8] | 0.150 [3] | Latency distribution: 10% in 0.0302 secs 25% in 0.0331 secs 50% in 0.0375 secs 75% in 0.0440 secs 90% in 0.0503 secs 95% in 0.0541 secs 99% in 0.0626 secs Details (average, fastest, slowest): DNS+dialup: 0.0000 secs, 0.0254 secs, 0.1495 secs DNS-lookup: 0.0000 secs, 0.0000 secs, 0.0000 secs req write: 0.0000 secs, 0.0000 secs, 0.0123 secs resp wait: 0.0390 secs, 0.0253 secs, 0.0835 secs resp read: 0.0001 secs, 0.0000 secs, 0.0216 secs Status code distribution: [403] 76538 responses
4. 配置一个有100k条IP白名单的授权策略
IP白名单，本机IP不在白名单中，所以保证配置的所有IP都会被搜索到。之后请求会被拒绝，返回403。
hey -z 60s http://${网关IP} Summary: Total: 60.1432 secs Slowest: 0.2374 secs Fastest: 0.0322 secs Average: 0.1360 secs Requests/sec: 367.4896 Total data: 419938 bytes Size/request: 19 bytes Response time histogram: 0.032 [1] | 0.053 [276] |■ 0.073 [821] |■■■■ 0.094 [491] |■■ 0.114 [308] |■ 0.135 [8860] |■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■ 0.155 [8594] |■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■ 0.176 [2400] |■■■■■■■■■■■ 0.196 [324] |■ 0.217 [22] | 0.237 [5] | Latency distribution: 10% in 0.1222 secs 25% in 0.1267 secs 50% in 0.1376 secs 75% in 0.1523 secs 90% in 0.1564 secs 95% in 0.1605 secs 99% in 0.1806 secs Details (average, fastest, slowest): DNS+dialup: 0.0001 secs, 0.0322 secs, 0.2374 secs DNS-lookup: 0.0000 secs, 0.0000 secs, 0.0000 secs req write: 0.0000 secs, 0.0000 secs, 0.0146 secs resp wait: 0.1357 secs, 0.0319 secs, 0.1963 secs resp read: 0.0001 secs, 0.0000 secs, 0.0102 secs Status code distribution: [403] 22102 responses
hey -z 60s http://${网关IP} Summary: Total: 60.0958 secs Slowest: 0.2464 secs Fastest: 0.0316 secs Average: 0.1362 secs Requests/sec: 366.9477 Total data: 418988 bytes Size/request: 19 bytes Response time histogram: 0.032 [1] | 0.053 [353] |■ 0.075 [761] |■■■ 0.096 [580] |■■ 0.117 [400] |■■ 0.139 [8765] |■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■ 0.160 [10164] |■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■ 0.182 [853] |■■■ 0.203 [149] |■ 0.225 [1] | 0.246 [25] | Latency distribution: 10% in 0.1213 secs 25% in 0.1297 secs 50% in 0.1403 secs 75% in 0.1504 secs 90% in 0.1544 secs 95% in 0.1597 secs 99% in 0.1803 secs Details (average, fastest, slowest): DNS+dialup: 0.0000 secs, 0.0316 secs, 0.2464 secs DNS-lookup: 0.0000 secs, 0.0000 secs, 0.0000 secs req write: 0.0000 secs, 0.0000 secs, 0.0054 secs resp wait: 0.1359 secs, 0.0314 secs, 0.2011 secs resp read: 0.0001 secs, 0.0000 secs, 0.0084 secs Status code distribution: [403] 22052 responses
hey -z 60s http://${网关IP} Summary: Total: 60.1537 secs Slowest: 0.2707 secs Fastest: 0.0310 secs Average: 0.1385 secs Requests/sec: 360.7094 Total data: 412262 bytes Size/request: 19 bytes Response time histogram: 0.031 [1] | 0.055 [555] |■■ 0.079 [539] |■■ 0.103 [555] |■■ 0.127 [8567] |■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■ 0.151 [1006] |■■■■ 0.175 [9542] |■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■ 0.199 [829] |■■■ 0.223 [83] | 0.247 [4] | 0.271 [17] | Latency distribution: 10% in 0.1144 secs 25% in 0.1183 secs 50% in 0.1353 secs 75% in 0.1641 secs 90% in 0.1688 secs 95% in 0.1737 secs 99% in 0.1928 secs Details (average, fastest, slowest): DNS+dialup: 0.0001 secs, 0.0310 secs, 0.2707 secs DNS-lookup: 0.0000 secs, 0.0000 secs, 0.0000 secs req write: 0.0000 secs, 0.0000 secs, 0.0051 secs resp wait: 0.1382 secs, 0.0296 secs, 0.2077 secs resp read: 0.0001 secs, 0.0000 secs, 0.0070 secs Status code distribution: [403] 21698 responses
可以看到，策略增加到100k，网关处理的时间增加大致为0.1s。
5. 配置一个特殊的20k条白名单
apiVersion: security.istio.io/v1beta1 kind: AuthorizationPolicy metadata: name: test namespace: istio-system spec: action: ALLOW selector: matchLabels: istio: ingressgateway rules: - from: - source: ipBlocks: - 0.0.0.1 - from: - source: ipBlocks: - 0.0.1.1 - from: - source: ipBlocks: - 0.1.0.1
hey -z 60s http://${网关IP} Summary: Total: 60.0307 secs Slowest: 0.2487 secs Fastest: 0.0304 secs Average: 0.1298 secs Requests/sec: 385.1030 Total data: 439242 bytes Size/request: 19 bytes Response time histogram: 0.030 [1] | 0.052 [453] |■ 0.074 [803] |■■ 0.096 [595] |■ 0.118 [360] |■ 0.140 [16061] |■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■ 0.161 [3932] |■■■■■■■■■■ 0.183 [551] |■ 0.205 [226] |■ 0.227 [95] | 0.249 [41] | Latency distribution: 10% in 0.1197 secs 25% in 0.1261 secs 50% in 0.1321 secs 75% in 0.1380 secs 90% in 0.1474 secs 95% in 0.1581 secs 99% in 0.1908 secs Details (average, fastest, slowest): DNS+dialup: 0.0001 secs, 0.0304 secs, 0.2487 secs DNS-lookup: 0.0000 secs, 0.0000 secs, 0.0000 secs req write: 0.0000 secs, 0.0000 secs, 0.0056 secs resp wait: 0.1295 secs, 0.0302 secs, 0.2487 secs resp read: 0.0001 secs, 0.0000 secs, 0.0183 secs Status code distribution: [403] 23118 responses
hey -z 60s http://${网关IP} Summary: Total: 60.0982 secs Slowest: 0.2830 secs Fastest: 0.0296 secs Average: 0.1334 secs Requests/sec: 374.7366 Total data: 427899 bytes Size/request: 19 bytes Response time histogram: 0.030 [1] | 0.055 [567] |■■ 0.080 [624] |■■ 0.106 [493] |■ 0.131 [5243] |■■■■■■■■■■■■■■■ 0.156 [13970] |■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■ 0.182 [1069] |■■■ 0.207 [371] |■ 0.232 [135] | 0.258 [0] | 0.283 [48] | Latency distribution: 10% in 0.1250 secs 25% in 0.1300 secs 50% in 0.1340 secs 75% in 0.1403 secs 90% in 0.1517 secs 95% in 0.1654 secs 99% in 0.2025 secs Details (average, fastest, slowest): DNS+dialup: 0.0001 secs, 0.0296 secs, 0.2830 secs DNS-lookup: 0.0000 secs, 0.0000 secs, 0.0000 secs req write: 0.0000 secs, 0.0000 secs, 0.0250 secs resp wait: 0.1331 secs, 0.0294 secs, 0.2830 secs resp read: 0.0001 secs, 0.0000 secs, 0.0063 secs Status code distribution: [403] 22521 responses
hey -z 60s http://${网关IP} Summary: Total: 60.1738 secs Slowest: 0.3209 secs Fastest: 0.0297 secs Average: 0.1489 secs Requests/sec: 335.7605 Total data: 383876 bytes Size/request: 19 bytes Response time histogram: 0.030 [1] | 0.059 [460] |■■ 0.088 [542] |■■ 0.117 [698] |■■■ 0.146 [10337] |■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■■ 0.175 [4071] |■■■■■■■■■■■■■■■■ 0.204 [2350] |■■■■■■■■■ 0.234 [1112] |■■■■ 0.263 [381] |■ 0.292 [109] | 0.321 [143] |■ Latency distribution: 10% in 0.1212 secs 25% in 0.1305 secs 50% in 0.1395 secs 75% in 0.1640 secs 90% in 0.1984 secs 95% in 0.2224 secs 99% in 0.2819 secs Details (average, fastest, slowest): DNS+dialup: 0.0001 secs, 0.0297 secs, 0.3209 secs DNS-lookup: 0.0000 secs, 0.0000 secs, 0.0000 secs req write: 0.0000 secs, 0.0000 secs, 0.0204 secs resp wait: 0.1485 secs, 0.0295 secs, 0.3208 secs resp read: 0.0001 secs, 0.0000 secs, 0.0119 secs Status code distribution: [403] 20204 responses
可以看到，如此配置之后，20k条判断策略让envoy的处理时间增加较多，直接增加了100～200ms。
总结
总体来说，授权策略中IP条数比较多对于envoy的影响还是比较小的。
通过本文的测试，在这里也给大家总结几条配置授权策略时的小原则：
- 太多IP规则时，首先考虑合并成少量的IPBlocks。
- 尽可能在少量的ipBlocks中配置多条IP（类似步骤3），而不是使用多个ipBlocks（类似步骤5）。
- 如果策略十分负载，使用多份授权策略管理策略。单一授权策略容易让Kubectl客户端报错，也不方便管理。
