External TLS Session Cache

[guydc]

Is your feature request related to a problem? Please describe.
TLS supports session resumption to improve performance. Envoy uses an in-memory TLS session cache. There are several consequences:

• When running Gloo Edge in HA mode, TLS session resumption can fail. When a client performs a TLS handshake with a certain envoy instance and then attempts to resume the session with a different instance, the resumption will fail.
• Sessions are not persistent across Gateway-Proxy pod restarts (evictions, rollout, etc.), which can also lead to resumption failure.

Describe the solution you'd like
An External TLS Session cache can solve this problem.

Describe alternatives you've considered
Using Session Tickets appears to be a better approach, as only the ticket private keys need to be shared by the envoy instances. However, Session Tickets may not be supported by all clients.

Additionally, the session cache should support configuration of cache record timeouts and maximum number of cached sessions.

Additional context
The same issue and was already raised in the envoy project: envoyproxy/envoy#14553.

[github-actions]

This issue has been marked as stale because of no activity in the last 180 days. It will be closed in the next 180 days unless it is tagged "no stalebot" or other activity occurs.