Gateway Virtual Service Destination Rule 外部请求 内部客户端 Service2 Service1 网格内部 定义网格入口 • 服务端口 • Host • TLS 配置 • 路由配置 • 根据 Host 路由 • 根据 Header • 根据 URI 路由 目的地流量策略配置 • LB 策略 • 连接池配置 • 断路器配置 • TLS 配置 Gateway External Envoy配置模型和xDS协议 ADS Server LDS RDS CDS EDS Envoy 配置模型的主要概念： • Downstream：连接到 Envoy 的下游 Host，发送请求并接收响应。 • Upstream： 上游 Host 接收来自 Envoy 的连接和请求，并返回响应。 • Listener：监听器是命名网地址（可以是TCP socket 或者 Unix domain socket)，可以被 0.0_9080 listener 的 http_connection_manager filter 配置，该请求采用 9080 route 进行分发。 6. 9080 这个 route 的配置中，host name 为 reviews:9080 的请求对应 的 cluster 为 outbound|9080||reviews.default.svc.cluster.local。 7. outbound|9080||reviews

reproduced. Description Istio VirtualServices define the sets of traffic routing rules to apply when a host is addressed. They support matching on various criteria including URI paths and header values and gateways: - test/bookinfo-gateway http: - match: - uri: exact: /productpage route: - destination: host: details.restrict-test.svc.cluster.local port: number: 9080 - match: - uri: exact: /login redirect: to be based on two things, which host name is more specific and which Gateway was created first. For example, in the event that an earlier-created Gateway includes a host declaration of "*", and an later-created

peer-authentication to enable server side mTLS mTLS in Istio - PeerAuthenticati on Using ingress port and ingress host to send request: can access reviews-v1, reviews-v2 and reviews-v3 can reach v2 as peer-authentication rule to enable client side mTLS mTLS in Istio - Destination rule Using ingress port and ingress host to send request: can access reviews-v1, reviews-v3 can not access reviews-v2 since we have enabled apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule metadata: name: reviews spec: host: reviews trafficPolicy: tls: mode: ISTIO_MUTUAL 1) Generate client and server certificates

sidecar traffic from 3 scopes ● Inbound ● Outbound ● Envoy to Envoy(same host) #IstioCon Dataflow After Acceleration(same host) #IstioCon ebpf Background Knowledge Prog type ● ebpf provide various network namespace #IstioCon Outbound Acceleration #IstioCon Envoy to Envoy Acceleration(same host) #IstioCon Performance Comparison #IstioCon Thank you!

TCP/IP stack 3 times ○ Inbound ○ Outbound ○ Envoy to Envoy(same host) Istio Meetup China Dataflow After Acceleration(same host) Istio Meetup China ebpf Background Knowledge Loader & Verification Istio Meetup China Outbound Acceleration Istio Meetup China Envoy to Envoy Acceleration(same host) Istio Meetup China Deploy eBPF Istio Meetup China Performance Comparison Refactored istio benchmarking

51ch62kjrnd.svc.cluster.local http: route: - destination: host: {revision-3}. 51ch62kjrnd.svc.cluster.local weight: 10 - destination: host: {revision-2}. 51ch62kjrnd.svc.cluster.local weight: 90 Knative Cloud Code Engine which fully managed, serverless platform(including knative and istio) that can host all of your cloud native workloads: https://www.ibm.com/cloud/code-engine ● Kperf, a public Knative

VMs accessing K8s SVCs 1. DNS query for httpbin.ns1.svc.cluster.local 2. DNS response – no such host httpbin.ns1.svc.cluster.local SVC IP: 10.4.4.4 #IstioCon DNS Issues on ext-TCP SVCs without VIPs ● Concurrency limitations ■ Lack of docs etc. #IstioCon VM High Performance Networking ● VM  Host IO interface ○ Relay ■ DPDK ○ Passthrough ■ SRIOV ● SRIOV ○ Single Root I/O Virtualization ○ Security (DDoS defense…) ● HW acceleration ○ Crypto ○ Rule matching ● Further isolation w/ host ● CapEx, OpEx #IstioCon RDMA (Remote Direct Memory Access) ● Advance transport protocol (same

Automation Indicator #7734 Add IBM Cloud Kubernetes Service specific instructions for node port Ingress Host #7663 Homepage Redesign Proposal #IstioCon #IstioCon “First and foremost: as a potential contributor

envoy_on_response(request_handle) #IstioCon Who and where to reroute ? #IstioCon The contract GET / HTTP/1.1 Host: example.com User-Agent: curl/7.64.1 X-devroute: { “foo”:”192.168.1.12:8001” } Accept: */* #IstioCon

director And leave a star ? #IstioCon How can we use istio-redirector ? The GitHub repository host also a HelmChart that you can use to deploy istio-redirector on your own cluster. Feel free to reach