[APR-205] app: ensure TLS subsystem initialization

[tobz]

Context

Currently, Saluki exclusively uses rustls as its TLS crate, primarily due to it being a Rust-based TLS solution that avoids depending on shared libraries, such as OpenSSL. Additionally, it has support for AWS-LC, which is a FIPS validated cryptography module that it can use as its "crypto provider", giving us a pathway to easy FIPS-compliant builds.

However, rustls also supports the ring crate as a provider. Normally, applications enable one feature or the other and things Just Work (tm), but in the case when both providers are enabled, additional code is needed to tell rustls which provider to use by default.

Another dependency -- kube -- transitively depends on rustls but explicitly enables the ring feature, which breaks things in ADP when trying to use rustls.

Solution

We've simply added a new initialization method to saluki_app to handle initializing TLS, which sets the AWS-LC provider as the default. We also did some cleanup around common crate features for the rustls and rustls-related crates, initially made when trying to debug the problem but left in place as it cleans things up a bit... even if it doesn't fix the problem on its own.

[pr-commenter[bot]]

Regression Detector (DogStatsD)

Regression Detector Results

Run ID: 05972b7d-d0f3-476f-a8db-93a63c5cebfc

Baseline: 7.52.0 Comparison: 7.52.1

Performance changes are noted in the perf column of each table:

• ✅ = significantly better comparison variant performance
• ❌ = significantly worse comparison variant performance
• ➖ = no significant change in performance

No significant changes in experiment optimization goals

Confidence level: 90.00% Effect size tolerance: |Δ mean %| ≥ 5.00%

There were no significant changes in experiment optimization goals at this confidence level and effect size tolerance.

Fine details of change detection per experiment

| perf | experiment | goal | Δ mean % | Δ mean % CI | links | |------|----------------------------------------------|--------------------|----------|----------------|-------| | ➖ | dsd_uds_100mb_3k_contexts_distributions_only | memory utilization | +1.34 | [+1.12, +1.55] | | | ➖ | dsd_uds_10mb_3k_contexts | ingress throughput | +0.06 | [+0.04, +0.09] | | | ➖ | dsd_uds_1mb_50k_contexts_memlimit | ingress throughput | +0.02 | [-0.01, +0.04] | | | ➖ | dsd_uds_100mb_250k_contexts | ingress throughput | +0.01 | [-0.03, +0.04] | | | ➖ | dsd_uds_500mb_3k_contexts | ingress throughput | +0.00 | [-0.00, +0.00] | | | ➖ | dsd_uds_1mb_3k_contexts | ingress throughput | -0.00 | [-0.04, +0.04] | | | ➖ | dsd_uds_100mb_3k_contexts | ingress throughput | -0.01 | [-0.02, -0.00] | | | ➖ | dsd_uds_512kb_3k_contexts | ingress throughput | -0.03 | [-0.11, +0.04] | | | ➖ | dsd_uds_1mb_50k_contexts | ingress throughput | -0.03 | [-0.06, -0.01] | |

Explanation

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI". For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true: 1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look. 2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that *if our statistical model is accurate*, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants. 3. Its configuration does not mark it "erratic".

[pr-commenter[bot]]

Regression Detector (Saluki)

Regression Detector Results

Run ID: 3bbfcfb1-2a17-47c0-883e-254e7760726b

Baseline: ba3850201f853d6d3027aed3baba7b650a5f42e8 Comparison: 89baecce8931f1c9aac32107f6d68d46d7436fd3

Performance changes are noted in the perf column of each table:

• ✅ = significantly better comparison variant performance
• ❌ = significantly worse comparison variant performance
• ➖ = no significant change in performance

No significant changes in experiment optimization goals

Confidence level: 90.00% Effect size tolerance: |Δ mean %| ≥ 5.00%

There were no significant changes in experiment optimization goals at this confidence level and effect size tolerance.

Fine details of change detection per experiment

| perf | experiment | goal | Δ mean % | Δ mean % CI | links | |------|-------------------------------------------------|--------------------|----------|----------------|-------| | ➖ | dsd_uds_500mb_3k_contexts | ingress throughput | +1.12 | [+1.02, +1.21] | | | ➖ | dsd_uds_1mb_50k_contexts_memlimit | ingress throughput | +0.62 | [-2.66, +3.90] | | | ➖ | dsd_uds_10mb_3k_contexts | ingress throughput | +0.02 | [-0.20, +0.23] | | | ➖ | dsd_uds_50mb_10k_contexts_no_inlining_no_allocs | ingress throughput | +0.01 | [-0.04, +0.06] | | | ➖ | dsd_uds_50mb_10k_contexts_no_inlining | ingress throughput | +0.00 | [-0.00, +0.00] | | | ➖ | dsd_uds_1mb_50k_contexts | ingress throughput | -0.00 | [-0.00, +0.00] | | | ➖ | dsd_uds_100mb_3k_contexts | ingress throughput | -0.00 | [-0.02, +0.02] | | | ➖ | dsd_uds_512kb_3k_contexts | ingress throughput | -0.01 | [-0.05, +0.03] | | | ➖ | dsd_uds_1mb_3k_contexts | ingress throughput | -0.06 | [-0.19, +0.07] | | | ➖ | dsd_uds_100mb_250k_contexts | ingress throughput | -0.11 | [-0.38, +0.16] | | | ➖ | dsd_uds_100mb_3k_contexts_distributions_only | memory utilization | -1.37 | [-1.51, -1.23] | |

Explanation

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI". For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true: 1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look. 2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that *if our statistical model is accurate*, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants. 3. Its configuration does not mark it "erratic".

[pr-commenter[bot]]

Regression Detector Links

Experiment Result Links

experiment	link(s)
dsd_uds_100mb_250k_contexts	[Profiling (ADP)] [Profiling (DSD)] [SMP Dashboard]
dsd_uds_100mb_3k_contexts	[Profiling (ADP)] [Profiling (DSD)] [SMP Dashboard]
dsd_uds_100mb_3k_contexts_distributions_only	[Profiling (ADP)] [Profiling (DSD)] [SMP Dashboard]
dsd_uds_10mb_3k_contexts	[Profiling (ADP)] [Profiling (DSD)] [SMP Dashboard]
dsd_uds_1mb_3k_contexts	[Profiling (ADP)] [Profiling (DSD)] [SMP Dashboard]
dsd_uds_1mb_50k_contexts	[Profiling (ADP)] [Profiling (DSD)] [SMP Dashboard]
dsd_uds_1mb_50k_contexts_memlimit	[Profiling (ADP)] [Profiling (DSD)] [SMP Dashboard]
dsd_uds_500mb_3k_contexts	[Profiling (ADP)] [Profiling (DSD)] [SMP Dashboard]
dsd_uds_512kb_3k_contexts	[Profiling (ADP)] [Profiling (DSD)] [SMP Dashboard]
dsd_uds_50mb_10k_contexts_no_inlining (ADP only)	[Profiling (ADP)] [SMP Dashboard]
dsd_uds_50mb_10k_contexts_no_inlining_no_allocs (ADP only)	[Profiling (ADP)] [SMP Dashboard]