3 ms·
You save shit all if every container comes with sidecar doing the actual TLS, it's extra component to debug and extra small latency added.
by adql 3y ago
You save shit all if every container comes with sidecar doing the actual TLS, it's extra component to debug and extra small latency added.
- pojzon 3y agoOr you can leverage ebpf like cillium.
- nijave 3y agoIn practice it's not that much. I think our Envoy sidecars take, maybe, 8mb of RAM when the apps are usually 500-1000MB. They usually add afaik <1ms latency. In addition, you can implement client side load balancing through Envoy so you can hit your services directly without intermediary load balancers. It adds complexity with the side car but usually you get standardized RED metrics regardless of if the service implemented them. You can also have the sidecar do connection pooling and maintain persistent or long lived TCP connections which ends up speeding things up without doing that at the app level.