diff --git a/benchmarks/README.md b/benchmarks/README.md index 36dc526..a250edd 100644 --- a/benchmarks/README.md +++ b/benchmarks/README.md @@ -4,21 +4,22 @@ This directory contains a benchmark suite for the Java version of the Tenant Sec To build and run the benchmark, just execute the following commands in this directory: To show single threaded latency of a roundtrip (encrypt/decrypt): + ``` mvn clean install -java -Xms1024m -Xmx1024m -jar target/benchmarks.jar -f0 -wi 1 +java -Xms1024m -Xmx1024m -jar target/benchmarks.jar -f 0 -wi 1 ``` -A variation that will show throughput using key leasing: +A variation that will show throughput instead: + ``` mvn clean install -TENANT_ID=tenant-gcp-l java -Xms1024m -Xmx1024m -jar target/benchmarks.jar -f 0 -wi 1 -bm thrpt -tu s +java -Xms1024m -Xmx1024m -jar target/benchmarks.jar -f 0 -wi 1 -bm thrpt -tu s ``` You have to benchmark an actual version of the TSC, though this can be a `SNAPSHOT` version published locally. Update the `pom.xml` to whatever version you'd like to test. - ## Tenant Security Proxy In order to run the benchmarks, the TSC needs to connect to a _Tenant Security Proxy (TSP)_. @@ -26,23 +27,30 @@ This service is provided as a Docker container, so it is easy to run the proxy o installed. IronCore Labs hosts the Docker container on a publicly accessible container registry, so you can pull the image from there and run it locally. -The TSP has a companion Docker container, the _Tenant Security Logdriver_ (LD) that runs alongside it in your environment. It is also hosted on the same publicly accessible container registry. - - In addition to the Docker containers, you need a configuration file that specifies how the TSP should communicate with the IronCore Labs Configuration Broker and Data Control Platform, which work together to enable the end-to-end encryption that keeps all of the tenant KMS configuration information secure. To simplify the process of running these examples, we have created a demo vendor and tenants that you can use for the examples; all the necessary configuration information is included in the [demo-tsp.conf](demo-tsp.conf) file in this directory. + **NOTE:** Normally, the file containing the configuration would be generated by the vendor and loaded into a Kubernetes secret or similar mechanism for securely loading the configuration into the docker container. We have included this configuration in the repository as a convenience. Also note that these accounts are all created in IronCore's staging infrastructure. -The following `docker-compose` command will get a TSP+LD running on your computer with the provided configuration: +Production TSPs will often be accompanied by one or more +[Tenant Security Logdriver](https://ironcorelabs.com/docs/saas-shield/tenant-security-logdriver/overview/) instances. +Because the purpose of this benchmark is to demonstrate the capabilities of the Tenant Security _Client_, we have chosen to not include +Logdriver in it. If you wish to modify the Docker Compose file to include Logdriver, be sure to consult its +[Deployment](https://ironcorelabs.com/docs/saas-shield/tenant-security-logdriver/deployment/) page to learn how to properly configure it +based on the resources you have available. + +The following `docker compose` command will get a TSP running on your computer with the provided configuration: + ``` -docker-compose -f docker-compose.yml up +docker compose up ``` + This starts the TSP locally listening on port 32804. The benchmark expects to connect to the TSP at that address. To connect with and use the TSP, you need to supply a couple more configuration values: @@ -66,7 +74,7 @@ There are six tenants defined; their IDs are the following: The last three are similar to the first three, but they have _key leasing_ enabled. -By default, the benchmark will use the `tenant-gcp` tenant. If you would like to experiment with a different tenant, just do: +By default, the benchmark will use the `tenant-gcp-l` tenant. If you would like to experiment with a different tenant, just do: ```bash export TENANT_ID=