Бенчмарк производительности StarVault

$ mkdir /tmp/learn-vault-benchmark

$ export HC_LEARN_LAB=/tmp/learn-vault-benchmark

$ vault-benchmark version

vault-benchmark v0.3.0

$ vault-benchmark --help

Usage: vault-benchmark <command> [args]

Command list:
   run         Run vault-benchmark test(s)
   review      Review previous test results

$ vault-benchmark run --help

Usage: vault-benchmark run [options]

This command will run a vault-benchmark test.

Run a vault-benchmark test with a configuration file:

   $ vault-benchmark run -config=/etc/vault-benchmark/test.hcl

For a full list of examples, please see the documentation.

Command Options:

-annotate=<string>
      Comma-separated name=value pairs include in bench_running prometheus
      metric. Try name 'testname' for dashboard example.

-audit_path=<string>
      Path to file for audit log.

-ca_pem_file=<string>
      Path to PEM encoded CA file to verify external Vault. This can also be
      specified via the VAULT_CACERT environment variable.

-cleanup
      Cleanup benchmark artifacts after run. The default is false.

-cluster_json=<string>
      Path to cluster.json file

-config=<string>
      Path to a vault-benchmark test configuration file.

-debug
      Run vault-benchmark in Debug mode. The default is false.

-disable_http2
      Force HTTP/1.1 The default is false.

-duration=<duration>
      Test Duration. The default is 10s.

-log_level=<string>
      Level to emit logs. Options are: INFO, WARN, DEBUG, TRACE. The default
      is INFO. This can also be specified via the VAULT_BENCHMARK_LOG_LEVEL
      environment variable.

-pprof_interval=<duration>
      Collection interval for vault debug pprof profiling.

-random_mounts
      Use random mount names. The default is true.

-report_mode=<string>
      Reporting Mode. Options are: terse, verbose, json. The default is terse.

-rps=<int>
      Requests per second. Setting to 0 means as fast as possible.

-vault_addr=<string>
      Target Vault API Address. The default is http://127.0.0.1:8200. This can
      also be specified via the VAULT_ADDR environment variable.

-vault_namespace=<string>
      Vault Namespace to create test mounts. This can also be specified via
      the VAULT_NAMESPACE environment variable.

-vault_token=<string>
      Vault Token to be used for test setup. This can also be specified via
      the VAULT_TOKEN environment variable.

-workers=<int>
      Number of workers The default is 10.

$ docker pull hashicorp/vault-benchmark

Using default tag: latest
latest: Pulling from hashicorp/vault-benchmark
4abcf2066143: Already exists
5db785bb5ae1: Pull complete
77cab26cbc7c: Pull complete
900c60e306e5: Pull complete
Digest: sha256:3f0ebc573b2615db5070bcfa724bd952c4b9f1679f17f7bf3ad3e678bb36a434
Status: Downloaded newer image for hashicorp/vault-benchmark:latest
docker.io/hashicorp/vault-benchmark:latest

$ docker run hashicorp/vault-benchmark vault-benchmark version

vault-benchmark v0.2.0

$ docker run hashicorp/vault-benchmark vault-benchmark --help

Usage: vault-benchmark <command> [args]

Command list:
   run         Run vault-benchmark test(s)
   review      Review previous test results

$ docker run hashicorp/vault-benchmark vault-benchmark run --help

Usage: vault-benchmark run [options]

This command will run a vault-benchmark test.

Run a vault-benchmark test with a configuration file:

   $ vault-benchmark run -config=/etc/vault-benchmark/test.hcl

For a full list of examples, please see the documentation.

Command Options:

-annotate=<string>
      Comma-separated name=value pairs include in bench_running prometheus
      metric. Try name 'testname' for dashboard example.

-audit_path=<string>
      Path to file for audit log.

-ca_pem_file=<string>
      Path to PEM encoded CA file to verify external Vault. This can also be
      specified via the VAULT_CACERT environment variable.

-cleanup
      Cleanup benchmark artifacts after run. The default is false.

-cluster_json=<string>
      Path to cluster.json file

-config=<string>
      Path to a vault-benchmark test configuration file.

-debug
      Run vault-benchmark in Debug mode. The default is false.

-disable_http2
      Force HTTP/1.1 The default is false.

-duration=<duration>
      Test Duration. The default is 10s.

-log_level=<string>
      Level to emit logs. Options are: INFO, WARN, DEBUG, TRACE. The default
      is INFO. This can also be specified via the VAULT_BENCHMARK_LOG_LEVEL
      environment variable.

-pprof_interval=<duration>
      Collection interval for vault debug pprof profiling.

-random_mounts
      Use random mount names. The default is true.

-report_mode=<string>
      Reporting Mode. Options are: terse, verbose, json. The default is terse.

-rps=<int>
      Requests per second. Setting to 0 means as fast as possible.

-vault_addr=<string>
      Target Vault API Address. The default is http://127.0.0.1:8200. This can
      also be specified via the VAULT_ADDR environment variable.

-vault_namespace=<string>
      Vault Namespace to create test mounts. This can also be specified via
      the VAULT_NAMESPACE environment variable.

-vault_token=<string>
      Vault Token to be used for test setup. This can also be specified via
      the VAULT_TOKEN environment variable.

-workers=<int>
      Number of workers The default is 10.

$ cat > "$HC_LEARN_LAB"/vault-benchmark-config.hcl << EOF
vault_addr = "http://127.0.0.1:8200"
vault_token = "root"
vault_namespace="root"
duration = "30s"
cleanup = true

test "approle_auth" "approle_logins" {
weight = 50
config {
   role {
      role_name = "benchmark-role"
      token_ttl="2m"
   }
}
}

test "kvv2_write" "static_secret_writes" {
weight = 50
config {
   numkvs = 100
   kvsize = 100
}
}
EOF

$ cat > "$HC_LEARN_LAB"/vault-benchmark-config.hcl << EOF
vault_addr = ""
vault_token = ""
vault_namespace=""
duration = "30s"
cleanup = true

test "approle_auth" "approle_logins" {
weight = 50
config {
   role {
      role_name = "benchmark-role"
      token_ttl="2m"
   }
}
}

test "kvv2_write" "static_secret_writes" {
weight = 50
config {
   numkvs = 100
   kvsize = 100
}
}
EOF

$ kubectl apply -f "$HC_LEARN_LAB"/vault-benchmark-job.yaml

$ kubectl get pods

$ kubectl logs --follow vault-benchmark-ghjlq

2025-05-21T10:33:14.986Z [INFO]  vault-benchmark: setting up targets
2025-05-21T10:33:17.352Z [INFO]  vault-benchmark: starting benchmarks: duration=30s
2025-05-21T10:34:42.187Z [INFO]  vault-benchmark: cleaning up targets
2025-05-21T10:34:46.496Z [INFO]  vault-benchmark: benchmark complete
Target: http://starvault:8200
op                    count  rate       throughput  mean          95th%         99th%           successRatio
kube_auth_test1       514    14.511228  5.991322    1.170117445s  1.100958326s  1m5.082967137s  98.64%
static_secret_writes  529    26.371231  6.215953    456.881766ms  266.507158ms  3.1722234s      99.43%

$ pkill starvault

$ rm -rf "$HC_LEARN_LAB"

$ unset STARVAULT_ADDR STARVAULT_TOKEN

$ rm -f ~/.vault-token

$ docker stop learn-starvault

$ docker network rm learn-starvault

$ rm -rf "$HC_LEARN_LAB"

$ unset STARVAULT_ADDR STARVAULT_TOKEN

$ kubectl delete jobs/vault-benchmark

job.batch "vault-benchmark" deleted

$ helm uninstall starvault

release "starvault" uninstalled

$ minikube delete
* Deleting "minikube" in kvm2 ...
* Removed all traces of the "minikube" cluster.

$ rm -rf "$HC_LEARN_LAB"

$ unset STARVAULT_ADDR STARVAULT_TOKEN