mirror of https://github.com/istio/istio.io.git
25 lines
36 KiB
HTML
25 lines
36 KiB
HTML
<!doctype html><html lang=en itemscope itemtype=https://schema.org/WebPage><head><meta charset=utf-8><meta http-equiv=x-ua-compatible content="IE=edge"><meta name=viewport content="width=device-width,initial-scale=1,shrink-to-fit=no"><meta name=theme-color content=#466BB0><meta name=title content="Best Practices: Benchmarking Service Mesh Performance"><meta name=description content="Tools and guidance for evaluating Istio's data plane performance."><meta name=author content="Megan O'Keefe (Google), John Howard (Google), Mandar Jog (Google)"><meta name=keywords content=microservices,services,mesh,performance,scalability,scale,benchmarks><meta property=og:title content="Best Practices: Benchmarking Service Mesh Performance"><meta property=og:type content=website><meta property=og:description content="Tools and guidance for evaluating Istio's data plane performance."><meta property=og:url content=/v1.3/blog/2019/performance-best-practices/><meta property=og:image content=/v1.3/img/istio-whitelogo-bluebackground-framed.svg><meta property=og:image:alt content="Istio Logo"><meta property=og:image:width content=112><meta property=og:image:height content=150><meta property=og:site_name content=Istio><meta name=twitter:card content=summary><meta name=twitter:site content=@IstioMesh><title>Istioldie 1.3 / Best Practices: Benchmarking Service Mesh Performance</title><script async src="https://www.googletagmanager.com/gtag/js?id=UA-98480406-2"></script><script>window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}
|
||
gtag('js',new Date());gtag('config','UA-98480406-2');</script><link rel=alternate type=application/rss+xml title="Istio Blog" href=/v1.3/blog/feed.xml><link rel=alternate type=application/rss+xml title="Istio News" href=/v1.3/news/feed.xml><link rel=alternate type=application/rss+xml title="Istio Blog and News" href=/v1.3/feed.xml><link rel="shortcut icon" href=/v1.3/favicons/favicon.ico><link rel=apple-touch-icon href=/v1.3/favicons/apple-touch-icon-180x180.png sizes=180x180><link rel=icon type=image/png href=/v1.3/favicons/favicon-16x16.png sizes=16x16><link rel=icon type=image/png href=/v1.3/favicons/favicon-32x32.png sizes=32x32><link rel=icon type=image/png href=/v1.3/favicons/android-36x36.png sizes=36x36><link rel=icon type=image/png href=/v1.3/favicons/android-48x48.png sizes=48x48><link rel=icon type=image/png href=/v1.3/favicons/android-72x72.png sizes=72x72><link rel=icon type=image/png href=/v1.3/favicons/android-96x96.png sizes=96xW96><link rel=icon type=image/png href=/v1.3/favicons/android-144x144.png sizes=144x144><link rel=icon type=image/png href=/v1.3/favicons/android-192x192.png sizes=192x192><link rel=manifest href=/v1.3/manifest.json><meta name=apple-mobile-web-app-title content=Istio><meta name=application-name content=Istio><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Work+Sans:400|Chivo:400|Work+Sans:500,300,600,300italic,400italic,500italic,600italic|Chivo:500,300,600,300italic,400italic,500italic,600italic"><link rel=stylesheet href=/v1.3/css/all.css><script src=/v1.3/js/themes_init.min.js></script></head><body class="language-unknown archive-site"><script>const branchName="release-1.3";const docTitle="Best Practices: Benchmarking Service Mesh Performance";const iconFile="\/v1.3/img/icons.svg";const buttonCopy='Copy to clipboard';const buttonPrint='Print';const buttonDownload='Download';</script><script src="https://www.google.com/cse/brand?form=search-form" defer></script><script src=/v1.3/js/all.min.js data-manual defer></script><header><nav><a id=brand href=/v1.3/><span class=logo><svg viewBox="0 0 300 300"><circle cx="150" cy="150" r="146" stroke-width="2" /><path d="M65 240H225L125 270z"/><path d="M65 230l60-10V110z"/><path d="M135 220l90 10L135 30z"/></svg></span><span class=name>Istioldie 1.3</span></a><div id=hamburger><svg class="icon"><use xlink:href="/v1.3/img/icons.svg#hamburger"/></svg></div><div id=header-links><a title="Learn how to deploy, use, and operate Istio." href=/v1.3/docs/>Docs</a>
|
||
<span title="Posts about using Istio.">Blog</span>
|
||
<a title="Timely news about the Istio project." href=/v1.3/news/2019/announcing-1.2-eol/>News</a>
|
||
<a title="Frequently Asked Questions about Istio." href=/v1.3/faq/>FAQ</a>
|
||
<a title="Get a bit more in-depth info about the Istio project." href=/v1.3/about/>About</a><div class=menu><button id=gearDropdownButton class=menu-trigger title="Options and settings" aria-label="Options and Settings" aria-controls=gearDropdownContent><svg class="icon"><use xlink:href="/v1.3/img/icons.svg#gear"/></svg></button><div id=gearDropdownContent class=menu-content aria-labelledby=gearDropdownButton role=menu><a tabindex=-1 role=menuitem class=active id=light-theme-item>Light Theme</a>
|
||
<a tabindex=-1 role=menuitem id=dark-theme-item>Dark Theme</a><div role=separator></div><a tabindex=-1 role=menuitem id=syntax-coloring-item>Color Examples</a><div role=separator></div><h6>Other versions of this site</h6><a tabindex=-1 role=menuitem onclick="navigateToUrlOrRoot('https://istio.io/blog\/2019\/performance-best-practices\/');return false;">Current Release</a>
|
||
<a tabindex=-1 role=menuitem onclick="navigateToUrlOrRoot('https://preliminary.istio.io/blog\/2019\/performance-best-practices\/');return false;">Next Release</a>
|
||
<a tabindex=-1 role=menuitem href=https://archive.istio.io>Older Releases</a></div></div><button id=search-show title="Search this site" aria-label=Search><svg class="icon"><use xlink:href="/v1.3/img/icons.svg#magnifier"/></svg></button></div><form id=search-form name=cse role=search><input type=hidden name=cx value=013699703217164175118:iwwf17ikgf4>
|
||
<input type=hidden name=ie value=utf-8>
|
||
<input type=hidden name=hl value=en>
|
||
<input type=hidden id=search-page-url value=/v1.3/search>
|
||
<input id=search-textbox class=form-control name=q type=search aria-label="Search this site">
|
||
<button id=search-close title="Cancel search" type=reset aria-label="Cancel search"><svg class="icon"><use xlink:href="/v1.3/img/icons.svg#cancel-x"/></svg></button></form></nav></header><main class=primary><div id=sidebar-container class="sidebar-container sidebar-offcanvas"><nav id=sidebar aria-label="Section Navigation"><div class=directory><div class=card><button class="header dynamic" id=card0 title="Blog posts for 2019." aria-controls=card0-body><svg class="icon"><use xlink:href="/v1.3/img/icons.svg#blog"/></svg>2019 Posts</button><div class="body default" aria-labelledby=card0 role=region id=card0-body><ul role=tree aria-expanded=true class=leaf-section aria-labelledby=card0><li role=none><a role=treeitem title="Configure Istio ingress gateway to act as a proxy for external services." href=/v1.3/blog/2019/proxy/>Istio as a Proxy for External Services</a></li><li role=none><a role=treeitem title="How can you use Istio to monitor blocked and passthrough external traffic." href=/v1.3/blog/2019/monitoring-external-service-traffic/>Monitoring blocked and passthrough external service traffic</a></li><li role=none><a role=treeitem title="Using Istio to secure multi-cloud Kubernetes applications with zero code changes." href=/v1.3/blog/2019/app-identity-and-access-adapter/>App Identity and Access Adapter</a></li><li role=none><a role=treeitem title="Demonstrates a Mixer out-of-process adapter which implements the Knative scale-from-zero logic." href=/v1.3/blog/2019/knative-activator-adapter/>Mixer out-of-process adapter for Knative</a></li><li role=none><a role=treeitem title="Taking advantage of Kubernetes trustworthy JWTs to issue certificates for workload instances more securely." href=/v1.3/blog/2019/trustworthy-jwt-sds/>Change in Secret Discovery Service in Istio 1.3</a></li><li role=none><a role=treeitem title="The design principles behind Istio's APIs and how those APIs are evolving." href=/v1.3/blog/2019/evolving-istios-apis/>The Evolution of Istio's APIs</a></li><li role=none><a role=treeitem title="Comparison of alternative solutions to control egress traffic including performance considerations." href=/v1.3/blog/2019/egress-traffic-control-in-istio-part-3/>Secure Control of Egress Traffic in Istio, part 3</a></li><li role=none><a role=treeitem title="Use Istio Egress Traffic Control to prevent attacks involving egress traffic." href=/v1.3/blog/2019/egress-traffic-control-in-istio-part-2/>Secure Control of Egress Traffic in Istio, part 2</a></li><li role=none><span role=treeitem class=current title="Tools and guidance for evaluating Istio's data plane performance.">Best Practices: Benchmarking Service Mesh Performance</span></li><li role=none><a role=treeitem title="Learn how to extend the lifetime of Istio self-signed root certificate." href=/v1.3/blog/2019/root-transition/>Extending Istio Self-Signed Root Certificate Lifetime</a></li><li role=none><a role=treeitem title="Attacks involving egress traffic and requirements for egress traffic control." href=/v1.3/blog/2019/egress-traffic-control-in-istio-part-1/>Secure Control of Egress Traffic in Istio, part 1</a></li><li role=none><a role=treeitem title="An overview of Istio 1.1 performance." href=/v1.3/blog/2019/istio1.1_perf/>Architecting Istio 1.1 for Performance</a></li><li role=none><a role=treeitem title="Configuring Istio route rules in a multicluster service mesh." href=/v1.3/blog/2019/multicluster-version-routing/>Version Routing in a Multicluster Service Mesh</a></li><li role=none><a role=treeitem title="Announces the new Istio blog policy." href=/v1.3/blog/2019/sail-the-blog/>Sail the Blog!</a></li><li role=none><a role=treeitem title="De-mystify how Istio manages to plugin its data-plane components into an existing deployment." href=/v1.3/blog/2019/data-plane-setup/>Demystifying Istio's Sidecar Injection Model</a></li><li role=none><a role=treeitem title="Verifies the performance impact of adding an egress gateway." href=/v1.3/blog/2019/egress-performance/>Egress Gateway Performance Investigation</a></li><li role=none><a role=treeitem title="Addressing application startup ordering and startup latency using AppSwitch." href=/v1.3/blog/2019/appswitch/>Sidestepping Dependency Ordering with AppSwitch</a></li><li role=none><a role=treeitem title="Describes how to deploy a custom ingress gateway using cert-manager manually." href=/v1.3/blog/2019/custom-ingress-gateway/>Deploy a Custom Ingress Gateway Using Cert-Manager</a></li></ul></div></div><div class=card><button class="header dynamic" id=card1 title="Blog posts for 2018." aria-controls=card1-body><svg class="icon"><use xlink:href="/v1.3/img/icons.svg#blog"/></svg>2018 Posts</button><div class=body aria-labelledby=card1 role=region id=card1-body><ul role=tree aria-expanded=true class=leaf-section aria-labelledby=card1><li role=none><a role=treeitem title="How to use Istio for traffic management without deploying sidecar proxies." href=/v1.3/blog/2018/incremental-traffic-management/>Incremental Istio Part 1, Traffic Management</a></li><li role=none><a role=treeitem title="Describes a simple scenario based on Istio's Bookinfo example." href=/v1.3/blog/2018/egress-mongo/>Consuming External MongoDB Services</a></li><li role=none><a role=treeitem title="Istio hosting an all day Twitch stream to celebrate the 1.0 release." href=/v1.3/blog/2018/istio-twitch-stream/>All Day Istio Twitch Stream</a></li><li role=none><a role=treeitem title="How HP is building its next-generation footwear personalization platform on Istio." href=/v1.3/blog/2018/hp/>Istio a Game Changer for HP's FitStation Platform</a></li><li role=none><a role=treeitem title="Automatic application onboarding and latency optimizations using AppSwitch." href=/v1.3/blog/2018/delayering-istio/>Delayering Istio with AppSwitch</a></li><li role=none><a role=treeitem title="Describe Istio's authorization feature and how to use it in various use cases." href=/v1.3/blog/2018/istio-authorization/>Micro-Segmentation with Istio Authorization</a></li><li role=none><a role=treeitem title="How to export Istio Access Logs to different sinks like BigQuery, GCS, Pub/Sub through Stackdriver." href=/v1.3/blog/2018/export-logs-through-stackdriver/>Exporting Logs to BigQuery, GCS, Pub/Sub through Stackdriver</a></li><li role=none><a role=treeitem title="Describes how to configure Istio for monitoring and access policies of HTTP egress traffic." href=/v1.3/blog/2018/egress-monitoring-access-control/>Monitoring and Access Policies for HTTP Egress Traffic</a></li><li role=none><a role=treeitem title="Introduction, motivation and design principles for the Istio v1alpha3 routing API." href=/v1.3/blog/2018/v1alpha3-routing/>Introducing the Istio v1alpha3 routing API</a></li><li role=none><a role=treeitem title="Describes how to configure Istio ingress with a network load balancer on AWS." href=/v1.3/blog/2018/aws-nlb/>Configuring Istio Ingress with AWS NLB</a></li><li role=none><a role=treeitem title="Using Kubernetes namespaces and RBAC to create an Istio soft multi-tenancy environment." href=/v1.3/blog/2018/soft-multitenancy/>Istio Soft Multi-Tenancy Support</a></li><li role=none><a role=treeitem title="An introduction to safer, lower-risk deployments and release to production." href=/v1.3/blog/2018/traffic-mirroring/>Traffic Mirroring with Istio for Testing in Production</a></li><li role=none><a role=treeitem title="Describes a simple scenario based on Istio's Bookinfo example." href=/v1.3/blog/2018/egress-tcp/>Consuming External TCP Services</a></li><li role=none><a role=treeitem title="Describes a simple scenario based on Istio's Bookinfo example." href=/v1.3/blog/2018/egress-https/>Consuming External Web Services</a></li></ul></div></div><div class=card><button class="header dynamic" id=card2 title="Blog posts for 2017." aria-controls=card2-body><svg class="icon"><use xlink:href="/v1.3/img/icons.svg#blog"/></svg>2017 Posts</button><div class=body aria-labelledby=card2 role=region id=card2-body><ul role=tree aria-expanded=true class=leaf-section aria-labelledby=card2><li role=none><a role=treeitem title="Improving availability and reducing latency." href=/v1.3/blog/2017/mixer-spof-myth/>Mixer and the SPOF Myth</a></li><li role=none><a role=treeitem title="Provides an overview of Mixer's plug-in architecture." href=/v1.3/blog/2017/adapter-model/>Mixer Adapter Model</a></li><li role=none><a role=treeitem title="How Kubernetes Network Policy relates to Istio policy." href=/v1.3/blog/2017/0.1-using-network-policy/>Using Network Policy with Istio</a></li><li role=none><a role=treeitem title="Using Istio to create autoscaled canary deployments." href=/v1.3/blog/2017/0.1-canary/>Canary Deployments using Istio</a></li><li role=none><a role=treeitem title="Istio Auth 0.1 announcement." href=/v1.3/blog/2017/0.1-auth/>Using Istio to Improve End-to-End Security</a></li></ul></div></div></div></nav></div><div class=article-container><button tabindex=-1 id=sidebar-toggler title="Toggle the navigation bar"><svg class="icon"><use xlink:href="/v1.3/img/icons.svg#pull"/></svg></button><nav aria-label=Breadcrumb><ol><li><a href=/v1.3/ title="Connect, secure, control, and observe services.">Istio</a></li><li><a href=/v1.3/blog/ title="Posts about using Istio.">Blog</a></li><li><a href=/v1.3/blog/2019/ title="Blog posts for 2019.">2019 Posts</a></li><li>Best Practices: Benchmarking Service Mesh Performance</li></ol></nav><article aria-labelledby=title><div class=title-area><div><h1 id=title>Best Practices: Benchmarking Service Mesh Performance</h1><p class=byline><span>By</span>
|
||
<span class=attribution>Megan O'Keefe (Google), John Howard (Google), Mandar Jog (Google)</span><span> | </span><span><svg class="icon"><use xlink:href="/v1.3/img/icons.svg#calendar"/></svg><span> </span>July 9, 2019<span> </span>(updated on September 5, 2019)</span><span> | </span><span title="1334 words"><svg class="icon"><use xlink:href="/v1.3/img/icons.svg#clock"/></svg><span> </span>7 minute read</span></p></div></div><nav class=toc-inlined aria-label="Table of Contents"><div><hr><ol><li role=none aria-label="1. Use a production-ready Istio installation"><a href=#1-use-a-production-ready-istio-installation>1. Use a production-ready Istio installation</a><li role=none aria-label="2. Focus on the data plane"><a href=#2-focus-on-the-data-plane>2. Focus on the data plane</a><li role=none aria-label="3. Measure with and without proxies"><a href=#3-measure-with-and-without-proxies>3. Measure with and without proxies</a><li role=none aria-label="Istio 1.2 Performance"><a href=#istio-1-2-performance>Istio 1.2 Performance</a><li role=none aria-label=Summary><a href=#summary>Summary</a><li role=none aria-label="See also"><a href=#see-also>See also</a></li></ol><hr></div></nav><p>Service meshes add a lot of functionality to application deployments, including <a href=/v1.3/docs/concepts/what-is-istio/#traffic-management>traffic policies</a>, <a href=/v1.3/docs/concepts/what-is-istio/#observability>observability</a>, and <a href=/v1.3/docs/concepts/what-is-istio/#security>secure communication</a>. But adding a service mesh to your environment comes at a cost, whether that’s time (added latency) or resources (CPU cycles). To make an informed decision on whether a service mesh is right for your use case, it’s important to evaluate how your application performs when deployed with a service mesh.</p><p>Earlier this year, we published a <a href=/v1.3/blog/2019/istio1.1_perf/>blog post</a> on Istio’s performance improvements in version 1.1. Following the release of <a href=/v1.3/news/2019/announcing-1.2>Istio 1.2</a>, we want to provide guidance and tools to help you benchmark Istio’s data plane performance in a production-ready Kubernetes environment.</p><p>Overall, we found that Istio’s <a href=/v1.3/docs/concepts/what-is-istio/#envoy>sidecar proxy</a> latency scales with the number of concurrent connections. At 1000 requests per second (RPS), across 16 connections, Istio adds <strong>3 milliseconds</strong> per request in the 50th percentile, and <strong>10 milliseconds</strong> in the 99th percentile.</p><p>In the <a href=https://github.com/istio/tools/tree/3ac7ab40db8a0d595b71f47b8ba246763ecd6213/perf/benchmark>Istio Tools repository</a>, you’ll find scripts and instructions for measuring Istio’s data plane performance, with additional instructions on how to run the scripts with <a href=https://linkerd.io>Linkerd</a>, another service mesh implementation. <a href=https://github.com/istio/tools/tree/3ac7ab40db8a0d595b71f47b8ba246763ecd6213/perf/benchmark#setup>Follow along</a> as we detail some best practices for each step of the performance test framework.</p><h2 id=1-use-a-production-ready-istio-installation>1. Use a production-ready Istio installation</h2><p>To accurately measure the performance of a service mesh at scale, it’s important to use an <a href=https://github.com/istio/tools/tree/3ac7ab40db8a0d595b71f47b8ba246763ecd6213/perf/istio-install#istio-setup>adequately-sized</a> Kubernetes cluster. We test using three worker nodes, each with at least 4 vCPUs and 15 GB of memory.</p><p>Then, it’s important to use a production-ready Istio <strong>installation profile</strong> on that cluster. This lets us achieve performance-oriented settings such as control plane pod autoscaling, and ensures that resource limits are appropriate for heavy traffic load. The <a href=/v1.3/docs/setup/install/helm/#option-1-install-with-helm-via-helm-template>default</a> Istio installation is suitable for most benchmarking use cases. For extensive performance benchmarking, with thousands of proxy-injected services, we also provide <a href=https://github.com/istio/tools/blob/3ac7ab40db8a0d595b71f47b8ba246763ecd6213/perf/istio-install/values.yaml>a tuned Istio install</a> that allocates extra memory and CPU to the Istio control plane.</p><p><svg class="large-icon"><use xlink:href="/v1.3/img/icons.svg#exclamation-mark"/></svg>Istio’s <a href=/v1.3/docs/setup/install/kubernetes/>demo installation</a> is not suitable for performance testing, because it is designed to be deployed on a small trial cluster, and has full tracing and access logs enabled to showcase Istio’s features.</p><h2 id=2-focus-on-the-data-plane>2. Focus on the data plane</h2><p>Our benchmarking scripts focus on evaluating the Istio data plane: the <span class=term data-title=Envoy data-body='<p>The high-performance proxy that Istio uses to mediate inbound and outbound traffic for all <a href="#service">services</a> in the
|
||
<a href="#service-mesh">service mesh</a>. <a href="https://envoyproxy.github.io/envoy/">Learn more about Envoy</a>.</p>'>Envoy</span> proxies that mediate traffic between application containers. Why focus on the data plane? Because at scale, with lots of application containers, the data plane’s <strong>memory</strong> and <strong>CPU</strong> usage quickly eclipses that of the Istio control plane. Let’s look at an example of how this happens:</p><p>Say you run 2,000 Envoy-injected pods, each handling 1,000 requests per second. Each proxy is using 50 MB of memory, and to configure all these proxies, Pilot is using 1 vCPU and 1.5 GB of memory. All together, the Istio data plane (the sum of all the Envoy proxies) is using 100 GB of memory, compared to Pilot’s 1.5 GB.</p><p>It is also important to focus on data plane performance for <strong>latency</strong> reasons. This is because most application requests move through the Istio data plane, not the control plane. There are two exceptions:</p><ol><li><strong>Telemetry reporting:</strong> Each proxy sends raw telemetry data to <span class=term data-title=Mixer data-body='<p>The Istio component is responsible for enforcing access control and usage policies across the <a href="#service-mesh">service mesh</a> and collecting telemetry data
|
||
from <a href="#envoy">Envoy</a> and other services.
|
||
<a href="/docs/reference/config/policy-and-telemetry/">Learn more about Mixer</a>.</p>'>Mixer</span>, which Mixer processes into metrics, traces, and other telemetry. The raw telemetry data is similar to access logs, and therefore comes at a cost. Access log processing consumes CPU and keeps a worker thread from picking up the next unit of work. At higher throughput, it is more likely that the next unit of work is waiting in the queue to be picked up by the worker. This can lead to long-tail (99th percentile) latency for Envoy.</li><li><strong>Custom policy checks:</strong> When using <a href=/v1.3/docs/concepts/observability/>custom Istio policy adapters</a>, policy checks are on the request path. This means that request headers and metadata on the data path will be sent to the control plane (Mixer), resulting in higher request latency. <strong>Note:</strong> These policy checks are <a href=/v1.3/docs/reference/config/installation-options/#global-options>disabled by default</a>, as the most common policy use case (<a href=/v1.3/docs/reference/config/authorization/istio.rbac.v1alpha1>RBAC</a>) is performed entirely by the Envoy proxies.</li></ol><p>Both of these exceptions will go away in a future Istio release, when <a href=https://docs.google.com/document/d/1QKmtem5jU_2F3Lh5SqLp0IuPb80_70J7aJEYu4_gS-s>Mixer V2</a> moves all policy and telemetry features directly into the proxies.</p><p>Next, when testing Istio’s data plane performance at scale, it’s important to test not only at increasing requests per second, but also against an increasing number of <strong>concurrent</strong> connections. This is because real-world, high-throughput traffic comes from multiple clients. The <a href=https://github.com/istio/tools/tree/3ac7ab40db8a0d595b71f47b8ba246763ecd6213/perf/benchmark#run-performance-tests>provided scripts</a> allow you to perform the same load test with any number of concurrent connections, at increasing RPS.</p><p>Lastly, our test environment measures requests between two pods, not many. The client pod is <a href=http://fortio.org/>Fortio</a>, which sends traffic to the server pod.</p><p>Why test with only two pods? Because scaling up throughput (RPS) and connections (threads) has a greater effect on Envoy’s performance than increasing the total size of the service registry — or, the total number of pods and services in the Kubernetes cluster. When the size of the service registry grows, Envoy does have to keep track of more endpoints, and lookup time per request does increase, but by a tiny constant. If you have many services, and this constant becomes a latency concern, Istio provides a <a href=/v1.3/docs/reference/config/networking/v1alpha3/sidecar/>Sidecar resource</a>, which allows you to limit which services each Envoy knows about.</p><h2 id=3-measure-with-and-without-proxies>3. Measure with and without proxies</h2><p>While many Istio features, such as <a href=/v1.3/docs/concepts/security/#mutual-tls-authentication>mutual TLS authentication</a>, rely on an Envoy proxy next to an application pod, you can <a href=/v1.3/docs/setup/additional-setup/sidecar-injection/#disabling-or-updating-the-webhook>selectively disable</a> sidecar proxy injection for some of your mesh services. As you scale up Istio for production, you may want to incrementally add the sidecar proxy to your workloads.</p><p>To that end, the test scripts provide <a href=https://github.com/istio/tools/tree/3ac7ab40db8a0d595b71f47b8ba246763ecd6213/perf/benchmark#run-performance-tests>three different modes</a>. These modes analyze Istio’s performance when a request goes through both the client and server proxies (<code>both</code>), just the server proxy (<code>serveronly</code>), and neither proxy (<code>baseline</code>).</p><p>You can also disable <a href=/v1.3/docs/concepts/observability/>Mixer</a> to stop Istio’s telemetry during the performance tests, which provides results in line with the performance we expect when the Mixer V2 work is completed. Istio also supports <a href=https://github.com/istio/istio/wiki/Envoy-native-telemetry>Envoy native telemetry</a>, which performs similarly to having Istio’s telemetry disabled.</p><h2 id=istio-1-2-performance>Istio 1.2 Performance</h2><p>Let’s see how to use this test environment to analyze the data plane performance of Istio 1.2. We also provide instructions to run the <a href=https://github.com/istio/tools/tree/3ac7ab40db8a0d595b71f47b8ba246763ecd6213/perf/benchmark/linkerd>same performance tests for the Linkerd data plane</a>. Currently, only latency benchmarking is supported for Linkerd.</p><p>For measuring Istio’s sidecar proxy latency, we look at the 50th, 90th, and 99th percentiles for an increasing number of concurrent connections,keeping request throughput (RPS) constant.</p><p>We found that with 16 concurrent connections and 1000 RPS, Istio adds <strong>3ms</strong> over the baseline (P50) when a request travels through both a client and server proxy. (Subtract the pink line, <code>base</code>, from the green line, <code>both</code>.) At 64 concurrent connections, Istio adds <strong>12ms</strong> over the baseline, but with Mixer disabled (<code>nomixer_both</code>), Istio only adds <strong>7ms</strong>.</p><figure style=width:75%><div class=wrapper-with-intrinsic-ratio style=padding-bottom:60%><a data-skipendnotes=true href=/v1.3/blog/2019/performance-best-practices/./latency_p50.png title="Istio sidecar proxy, 50th percentile latency"><img class=element-to-stretch src=/v1.3/blog/2019/performance-best-practices/./latency_p50.png alt="Istio sidecar proxy, 50th percentile latency"></a></div><figcaption></figcaption></figure><p>In the 90th percentile, with 16 concurrent connections, Istio adds <strong>6ms</strong>; with 64 connections, Istio adds <strong>20ms</strong>.</p><figure style=width:75%><div class=wrapper-with-intrinsic-ratio style=padding-bottom:60%><a data-skipendnotes=true href=/v1.3/blog/2019/performance-best-practices/./latency_p90.png title="Istio sidecar proxy, 90th percentile latency"><img class=element-to-stretch src=/v1.3/blog/2019/performance-best-practices/./latency_p90.png alt="Istio sidecar proxy, 90th percentile latency"></a></div><figcaption></figcaption></figure><p>Finally, in the 99th percentile, with 16 connections, Istio adds <strong>10ms</strong> over the baseline. At 64 connections, Istio adds <strong>25ms</strong> with Mixer, or <strong>10ms</strong> without Mixer.</p><figure style=width:75%><div class=wrapper-with-intrinsic-ratio style=padding-bottom:60%><a data-skipendnotes=true href=/v1.3/blog/2019/performance-best-practices/./latency_p99.png title="Istio sidecar proxy, 99th percentile latency"><img class=element-to-stretch src=/v1.3/blog/2019/performance-best-practices/./latency_p99.png alt="Istio sidecar proxy, 99th percentile latency"></a></div><figcaption></figcaption></figure><p>For CPU usage, we measured with an increasing request throughput (RPS), and a constant number of concurrent connections. We found that Envoy’s maximum CPU usage at 3000 RPS, with Mixer enabled, was <strong>1.2 vCPUs</strong>. At 1000 RPS, one Envoy uses approximately half of a CPU.</p><figure style=width:75%><div class=wrapper-with-intrinsic-ratio style=padding-bottom:60%><a data-skipendnotes=true href=/v1.3/blog/2019/performance-best-practices/./cpu_max.png title="Istio sidecar proxy, max CPU usage"><img class=element-to-stretch src=/v1.3/blog/2019/performance-best-practices/./cpu_max.png alt="Istio sidecar proxy, max CPU usage"></a></div><figcaption></figcaption></figure><h2 id=summary>Summary</h2><p>In the process of benchmarking Istio’s performance, we learned several key lessons:</p><ul><li>Use an environment that mimics production.</li><li>Focus on data plane traffic.</li><li>Measure against a baseline.</li><li>Increase concurrent connections as well as total throughput.</li></ul><p>For a mesh with 1000 RPS across 16 connections, Istio 1.2 adds just <strong>3 milliseconds</strong> of latency over the baseline, in the 50th percentile.</p><div><aside class="callout tip"><div class=type><svg class="large-icon"><use xlink:href="/v1.3/img/icons.svg#callout-tip"/></svg></div><div class=content>Istio’s performance depends on your specific setup and traffic load. Because of this variance, make sure your test setup accurately reflects your production workloads. To try out the benchmarking scripts, head over <a href=https://github.com/istio/tools/tree/3ac7ab40db8a0d595b71f47b8ba246763ecd6213/perf/benchmark>to the Istio Tools repo</a>.</div></aside></div><p>Also check out the <a href=/v1.3/docs/concepts/performance-and-scalability>Istio Performance and Scalability guide</a> for the most up-to-date performance data for current and future releases.</p><p>Thank you for reading, and happy benchmarking!</p><nav id=see-also><h2>See also</h2><div class=see-also><div class=entry><p class=link><a data-skipendnotes=true href=/v1.3/blog/2019/istio1.1_perf/>Architecting Istio 1.1 for Performance</a></p><p class=desc>An overview of Istio 1.1 performance.</p></div><div class=entry><p class=link><a data-skipendnotes=true href=/v1.3/docs/concepts/performance-and-scalability/>Performance and Scalability</a></p><p class=desc>Introduces performance and scalability for Istio.</p></div><div class=entry><p class=link><a data-skipendnotes=true href=/v1.3/blog/2019/egress-performance/>Egress Gateway Performance Investigation</a></p><p class=desc>Verifies the performance impact of adding an egress gateway.</p></div><div class=entry><p class=link><a data-skipendnotes=true href=/v1.3/blog/2019/appswitch/>Sidestepping Dependency Ordering with AppSwitch</a></p><p class=desc>Addressing application startup ordering and startup latency using AppSwitch.</p></div><div class=entry><p class=link><a data-skipendnotes=true href=/v1.3/blog/2018/delayering-istio/>Delayering Istio with AppSwitch</a></p><p class=desc>Automatic application onboarding and latency optimizations using AppSwitch.</p></div></div></nav></article><nav class=pagenav><div class=left><a title="Use Istio Egress Traffic Control to prevent attacks involving egress traffic." href=/v1.3/blog/2019/egress-traffic-control-in-istio-part-2/><svg class="icon"><use xlink:href="/v1.3/img/icons.svg#left-arrow"/></svg>Secure Control of Egress Traffic in Istio, part 2</a></div><div class=right><a title="Learn how to extend the lifetime of Istio self-signed root certificate." href=/v1.3/blog/2019/root-transition/>Extending Istio Self-Signed Root Certificate Lifetime<svg class="icon"><use xlink:href="/v1.3/img/icons.svg#right-arrow"/></svg></a></div></nav><div id=endnotes-container aria-hidden=true><h2>Links</h2><ol id=endnotes></ol></div></div><div class=toc-container><nav class=toc aria-label="Table of Contents"><div id=toc><ol><li role=none aria-label="1. Use a production-ready Istio installation"><a href=#1-use-a-production-ready-istio-installation>1. Use a production-ready Istio installation</a><li role=none aria-label="2. Focus on the data plane"><a href=#2-focus-on-the-data-plane>2. Focus on the data plane</a><li role=none aria-label="3. Measure with and without proxies"><a href=#3-measure-with-and-without-proxies>3. Measure with and without proxies</a><li role=none aria-label="Istio 1.2 Performance"><a href=#istio-1-2-performance>Istio 1.2 Performance</a><li role=none aria-label=Summary><a href=#summary>Summary</a><li role=none aria-label="See also"><a href=#see-also>See also</a></li></ol></div></nav></div></main><footer><div class=user-links><a class=channel title="Go download Istio 1.3.5 now" href=/v1.3/docs/setup#downloading-the-release aria-label="Download Istio"><span>download</span><svg class="icon"><use xlink:href="/v1.3/img/icons.svg#download"/></svg>
|
||
</a><a class=channel title="Join the Istio discussion board to participate in discussions and get help troubleshooting problems" href=https://discuss.istio.io aria-label="Istio discussion board"><span>discuss</span><svg class="icon"><use xlink:href="/v1.3/img/icons.svg#discourse"/></svg></a>
|
||
<a class=channel title="Stack Overflow is where you can ask questions and find curated answers on deploying, configuring, and using Istio" href=https://stackoverflow.com/questions/tagged/istio aria-label="Stack Overflow"><span>stack overflow</span><svg class="icon"><use xlink:href="/v1.3/img/icons.svg#stackoverflow"/></svg></a>
|
||
<a class=channel title="Interactively discuss issues with the Istio community on Slack" href=https://istio.slack.com aria-label=slack><span>slack</span><svg class="icon"><use xlink:href="/v1.3/img/icons.svg#slack"/></svg></a>
|
||
<a class=channel title="Follow us on Twitter to get the latest news" href=https://twitter.com/IstioMesh aria-label=Twitter><span>twitter</span><svg class="icon"><use xlink:href="/v1.3/img/icons.svg#twitter"/></svg></a><div class=tag>for everyone</div></div><div class=info><p class=copyright>Istio Archive
|
||
1.3.5<br>© 2019 Istio Authors, <a href=https://policies.google.com/privacy>Privacy Policy</a><br>Archived on November 14, 2019</p></div><div class=dev-links><a class=channel title="GitHub is where development takes place on Istio code" href=https://github.com/istio/community aria-label=GitHub><span>github</span><svg class="icon"><use xlink:href="/v1.3/img/icons.svg#github"/></svg></a>
|
||
<a class=channel title="Access our team drive if you'd like to take a look at the Istio technical design documents" href=https://groups.google.com/forum/#!forum/istio-team-drive-access aria-label="team drive"><span>drive</span><svg class="icon"><use xlink:href="/v1.3/img/icons.svg#drive"/></svg></a>
|
||
<a class=channel title="If you'd like to contribute to the Istio project, consider participating in our working groups" href=https://github.com/istio/community/blob/master/WORKING-GROUPS.md aria-label="working groups"><span>working groups</span><svg class="icon"><use xlink:href="/v1.3/img/icons.svg#working-groups"/></svg></a><div class=tag>for developers</div></div></footer><script src=https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js defer></script><div id=scroll-to-top-container aria-hidden=true><button id=scroll-to-top title="Back to top"><svg class="icon"><use xlink:href="/v1.3/img/icons.svg#top"/></svg></button></div></body></html> |