Characterise the Istio & Istio+Ory gateway for performance

[vijayg10]

Goal:

As a Mojaloop Adopter making use of the IaC deployment

I want to understand the performance characterisation of the Istio Gateway

so that I can understand and plan for it’s appropriate deployment and cost in a mojaloop or payment manager deployment

Acceptance Criteria:

• [x] Verify that a testing harness is created to run the test of Istio gateway in isolation. The gateway must always use TLS encryption; and must cater for the following modes:
  • [x] Without Ory Connected
  • [x] \With Ory performing JWT Authentication (Ory Oathkeeper is deployed)
  • [x] With Ory JWT Authentication and Keto Authorization (Ory Oathkeeper and Ory Keto are deployed)
• [x] Verify that the performance and the hardware requirement of Istio is understood
• [x] Verify that the impact of enabling JWT Authentication using the Ory Stack is understood.
• [x] Verify that the impact of enabling Authorization using the Ory Stack is understood.
• [x] Document the findings
• [x] Document the manual steps to run this
• [x] If minor configuration changes are required to improve the performance, then include these configuration changes of Istio and Ory. If a problem is identifies that requires more work than can be done in the story, then create a story based on findings.

Note: Reference Ory JWT Authentication: https://www.ory.sh/docs/oathkeeper/pipeline/authn#jwt

Suggested approach:

• Deploy a PM4ML and onboard using connection manager
• Deploy callback-handler-simulator-svc (https://github.com/mojaloop/callback-handler-simulator-svc)
• Obtain mTLS certs to be used in K6 and to be used
• Get Access token directly from Keycloak using scripts (ask Eugen)
• Use POST quotes so that we can test message with some payload

Complexity: <High|Medium|Low> > A short comment to remind the reason for the rating

Uncertainty: <High|Medium|Low> > A short comment to remind the reason for the rating

---

Tasks:

• [x] Acquire test environment [ @elnyry-sam-k @PaulGregoryBaker @oderayi ]
• [x] Setup test environment in AWS - [Done in IPROD-671]
  • [x] Deploy ML environment (Istio gateway, Ory Oathkeeper, Ory Keto, Connection Manager, Keycloak) - [Done in IPROD-671]
  • [x] Deploy PM4ML environment - [Done in IPROD-671]
  • [x] Deploy K6 environment/VM - [Done in IPROD-671]
• [x] Validate deployed services and configurations - [Done]
• [x] Setup simulator in ML env - [Done]
• [x] Develop K6 tests - [Done]
• [x] Run tests and document results for different setup scenarios and optimizations - [Done]

Done

• [x] Acceptance Criteria pass
• [x] Designs are up-to date
• [x] Unit Tests pass
• [x] Integration Tests pass
• [x] Code Style & Coverage meets standards
• [x] Changes made to config (default.json) are broadcast to team and follow-up tasks added to update helm charts and other deployment config.
• [x] TBD

Pull Requests:

• [x] https://github.com/mojaloop/ml-perf-characterization/pull/20

Follow-up:

• N/A

Dependencies:

• N/A

Accountability:

• Owner: TBC
• QA/Review: TBC

[vijayg10]

Attaching the drawing from the discussion

[PaulGregoryBaker]

5 pts left