Garvit Varshney
Software Engineer in Marvell Technology
Actions
Garvit Varshney is a Software Engineer at Marvell Technology, where he works on cloud and networking solutions. He is skilled in the SONiC, SAI, VPP, DPDK, OpenSSL, Kubernetes, and cloud-native technologies, with a strong focus on delivering innovative solutions by leveraging cutting-edge technology.
Bringing Flow Awareness to SONiC HFT: Operator-Configured and Hardware-Learned Flows
SONiC's High-Frequency Telemetry (HFT) framework today streams port, queue, and buffer counters via TAM_COUNTER_SUBSCRIPTION, IPFIX, and OpenTelemetry — a well-established path from ASIC to CounterSyncd to Collector. Per-flow telemetry, however, is currently outside HFT's scope: SAI_TAM_TELEMETRY_TYPE_FLOW exists in the SAI specification but is under-specified, and SONiC has no ingestion path for flow records.
This session presents work to close that gap. We extend HFT to carry per-flow IPFIX records — for both operator-configured flows, defined by ACL entries bound to a TAM object via the existing SAI_ACL_ENTRY_ATTR_ACTION_TAM_OBJECT action, and hardware auto-learned flows, enabled by a new switch-level SAI attribute being proposed upstream. We walk through the SAI additions, the CounterSyncd extensions needed to consume flow templates, and the CONFIG_DB and STATE_DB schema.
Target Applications: ML-based traffic analytics, elephant-flow detection, tenant SLA monitoring, and security anomaly workflows — all of which need per-flow visibility that today's HFT cannot provide.
Envoy Meets DPDK: Unlocking Scalable, Hardware-Agnostic TLS Performance
Envoy is a widely used Layer 7 proxy often deployed at the network edge to terminate large volumes of TLS connections, but the high CPU cost of TLS handshakes can limit scalability. To address this, we leveraged Envoy's Private Key Provider extension to enable asynchronous execution of custom private key operations. By integrating the DPDK crypto API, we offloaded sign operation to hardware, enabling high-throughput TLS handshakes across DPDK-compatible platforms. Our implementation is hardware-agnostic and would work seamlessly with all DPDK-compatible devices. We validated our solution on the OCTEON 10 platform, which features industry-leading cryptographic performance. Using 2K-bit RSA certificate, we achieved 2.5K TLS handshakes per second (QPS) with a single Envoy worker and scaled to 20K QPS with multiple workers—all with low power usage. We present the design, integration, and performance data demonstrating the scalability and efficiency of hardware acceleration TLS at the edge.
Scaling Envoy TLS with DPDK and Hardware Acceleration
Envoy, as an L7 proxy, uses BoringSSL as its default TLS library. As an edge proxy, Envoy handles numerous TLS connections, which can reduce queries per second per core. However, by utilizing the asynchronous private key provider framework with DPDK user-space crypto drivers, TLS processing can be fully offloaded to user space, leading to significant performance improvements. This approach eliminates context switches and buffer copies between kernel and user space.
In our implementation, DPDK's rte crypto APIs are used to handle sign and decrypt operations, ensuring a vendor-neutral solution. Initial observations indicate performance gains of up to 44% overall, and up to 80% on handshakes, by leveraging hardware crypto acceleration with the OCTEON SoC (RSA 2k certificates). By processing cryptographic operations in user space and offloading them to the accelerator device, Envoy can process more requests concurrently, significantly reducing handshake cycles and improving throughput.
Cilium on OCTEON10: Unleashing the DPU Compute Potential
Cilium, an open-source CNI, leverages eBPF data planes to deliver exceptional performance, secure connectivity, and networking for cloud-native workloads. High-performance cluster deployments currently integrate smartNICs and DPUs providing latent compute capacities. These DPUs house power-efficient compute cores with dedicated accelerations for networking and cryptographic workloads, aligning seamlessly with the demands of high-performance CNIs. In our study, we deploy a Cilium Cluster on an OCTEON 10 DPU and benchmark key performance metrics. The focus is on analyzing Cilium's performance on DPUs equipped with low-powered ARM cores. The obtained results demonstrate significant promise, exhibiting competitive performance compared to similar tests conducted on a high-end Xeon processor. Further optimization is achievable by harnessing specialized workload accelerators, thereby enhancing cluster efficiency in terms of power, performance, and costs.
"Enhancing Cloud Efficiency: ARM N2 Cores in Service Mesh Deployments"
A service mesh enhances the security, reliability, and observability of microservices communication. By examining Istio's Service Mesh and its use of the Gateway API for edge load balancing, we can see how it manages traffic through Envoy proxies and supports layer 4-6 load balancing. While these features offer robust traffic management, they can place significant demands on server resources. To address this, we explore the deployment of Istio Service Mesh on power- and cost-efficient ARM N2 cores, focusing on performance metrics. Leveraging these cores allows for effective handling of network and compute-intensive tasks, significantly reducing power consumption and costs. We will present data demonstrating how these strategies enhance cluster efficiency and performance, meeting the demands of next-generation cloud-native environments.
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top