contrib: add QAT private key provider. (#21984)
Next generation Intel® QAT support with Intel® Xeon® Scalable processors will feature an Intel® QAT cryptography and compression acceleration engine. QAT private key provider extension will use qatlib library (https://github.com/intel/qatlib) to accelerate RSA operations in handshakes. The extension will look a bit like the existing cryptomb private key provider. The use case is to move the expensive cryptographic operations away from the CPU to the accelerator device, leaving CPU cycles for other use. Support for Intel® QAT is already present in the mainline Linux kernel and in Kubernetes device plugins (to expose the device files to containers). There are previous generations of Intel QAT® hardware devices, but they are not supported by this extension. Signed-off-by: Ismo Puustinen <ismo.puustinen@intel.com> Mirrored from https://github.com/envoyproxy/envoy @ 9447ff5bfa8081fc2ddd5918b8ee9c1fd6720c7apull/626/head
data-plane-api(Azure Pipelines)
2 years ago
parent
bf6154e482
commit
10f885ae8e
4 changed files with 54 additions and 0 deletions
@ -0,0 +1,12 @@ |
||||
# DO NOT EDIT. This file is generated by tools/proto_format/proto_sync.py. |
||||
|
||||
load("@envoy_api//bazel:api_build_system.bzl", "api_proto_package") |
||||
|
||||
licenses(["notice"]) # Apache 2 |
||||
|
||||
api_proto_package( |
||||
deps = [ |
||||
"//envoy/config/core/v3:pkg", |
||||
"@com_github_cncf_udpa//udpa/annotations:pkg", |
||||
], |
||||
) |
||||
@ -0,0 +1,40 @@ |
||||
syntax = "proto3"; |
||||
|
||||
package envoy.extensions.private_key_providers.qat.v3alpha; |
||||
|
||||
import "envoy/config/core/v3/base.proto"; |
||||
|
||||
import "google/protobuf/duration.proto"; |
||||
|
||||
import "udpa/annotations/sensitive.proto"; |
||||
import "udpa/annotations/status.proto"; |
||||
import "validate/validate.proto"; |
||||
|
||||
option java_package = "io.envoyproxy.envoy.extensions.private_key_providers.qat.v3alpha"; |
||||
option java_outer_classname = "QatProto"; |
||||
option java_multiple_files = true; |
||||
option go_package = "github.com/envoyproxy/go-control-plane/envoy/extensions/private_key_providers/qat/v3alpha"; |
||||
option (udpa.annotations.file_status).package_version_status = ACTIVE; |
||||
|
||||
// [#protodoc-title: `QAT` private key provider] |
||||
// [#extension: envoy.tls.key_providers.qat] |
||||
|
||||
// This message specifies how the private key provider is configured. |
||||
// The private key provider provides RSA sign and decrypt operation |
||||
// hardware acceleration. |
||||
|
||||
message QatPrivateKeyMethodConfig { |
||||
// Private key to use in the private key provider. If set to inline_bytes or |
||||
// inline_string, the value needs to be the private key in PEM format. |
||||
config.core.v3.DataSource private_key = 1 [(udpa.annotations.sensitive) = true]; |
||||
|
||||
// How long to wait before polling the hardware accelerator after a |
||||
// request has been submitted there. Having a small value leads to |
||||
// quicker answers from the hardware but causes more polling loop |
||||
// spins, leading to potentially larger CPU usage. The duration needs |
||||
// to be set to a value greater than or equal to 1 millisecond. |
||||
google.protobuf.Duration poll_delay = 2 [(validate.rules).duration = { |
||||
required: true |
||||
gte {nanos: 1000000} |
||||
}]; |
||||
} |
||||
Loading…
Reference in new issue