Per T352744 , "Upgrading to bookworm implies moving from OpenSSL 1.1.x to OpenSSL 3.x. HAProxy is quite vocal about OpenSSL 3.x performance as it can be seen on https://github.com/haproxy/wiki/wiki/SSL-Libraries-Support-Status#openssl and https://github.com/openssl/openssl/issues/17627#issuecomment-1060123659."

The suggested workaround in the ticket is to use Envoy, which is based off boringssl. This is relevant to DPE SRE, as Elastic currently uses nginx for TLS termination. Using envoy should give us other benefits, such as the ability to cut around LVS when talking to internal services (see T351475 for an example of where this might have been useful).

Creating this ticket to:

• Decide whether to implement Envoy (discuss with DPE SRE and Search platform SWE)
• If we decide to implement, create subtasks for implementation.