CLB 对外请求 对外请求（Passthrough/ServiceEntry） 缺省路由 （服务名） 5 Istio 流量管理 – 数据面 – Envoy配置模型和xDS协议 ADS Server LDS RDS CDS EDS Envoy 配置模型的主要概念： • Downstream：连接到 Envoy 的下游 Host，发送请求并接收响应。 • Upstream： 上游 Host 接收来自 ：集群中的服务实例发现服务。 • Secret Discovery Service (SDS) ：证书发现服务。 • Aggregated Discovery Service(ADS): 通过一个Aggregated Server提供所有xDS服务，以解 决各个不同xDS服务的顺序导致的数据一致性问题。 gRPC/REST: update config on the fly 6 Istio 流量管理 – 数据面 – header 进行路由，请求原始目的 IP 不应影响路由结果 入向请求配置 出向请求配置 0.0.0.0_9080 0.0.0.0_15001 0.0.0.0_15006 Pilot (ADS Server) LDS RDS CDS EDS Services Traffic Rules 7 Istio 流量管理 – 数据面 – Envoy Sidecar Inbound 配置 入向请求配

proxy in the outbound listener Replace TCP proxy in the inbound listener client Server v1 30% 70% Server v2 9090 9090 #IstioCon EnvoyFilter is Powerful, But ... It’s very difficult if service from the standpoint of Istio. Visit Github to get more information https://github.com/aeraki-framework/aeraki #IstioCon Aeraki Configuration Example: Dubbo Service definition Traffic rules #IstioCon

documentation on upgrades across all supported methods ○ Test documentation using istio.io test framework #IstioCon Upgrade Working Group - User Experience ● Add pre-checks to identify and warn about

and provides aggregated data of Knative Service ready duration. o Knative Performance Testing Framework 2 Design #IstioCon o Ingress gateway MEM has linear growth, and it consumes ~=750k for 1 Knative

recommended MaxBytesHandler was used, the request body was not fully consumed, meaning that when a server attempts to read HTTP2 frames from the connection it will instead be reading the body. As such, the FuzzBuildSecurityCaller istio.io/istio/security/pkg/ server/ca https://github.com/istio/istio/blob/6 5478ea81272c0ceaab568974aff7 00aef907312/security/pkg/server/c a/authenticate/fuzz_test.go#L21 The fuzzers typically is Istiod. 2. To receive ADS requests from Envoy and forward these to the specified discovery server which typically is Istiod. Istiod handles certificate signing requests via the IstioCAServiceServer

Request Cert (SDS)) 3. CSR Auth: JWT 4. Cert signed with SPIFFE format Istio-proxy CA server #IstioCon Istio identity – how to get configuration ● Format: "spiffe:///ns/server side mTLS mTLS in Istio - PeerAuthenticati on Using ingress port and ingress host to send request: peer-authentication only defines behavior of server side and auto-mTLS is on by default Access productpage 1) Apply peer-authentication to enable server side mTLS mTLS in Istio - PeerAuthenticati

packet dest ip + port and forward it to POSTROUTING ④ send out to real server Note: Only one connection between user and real server #IstioCon HAPROXY- Transparent Transport ① user send traffic to haproxy connection ④ Loadbalancing: select a endpoint and init a connection to server with original user’s address (IP_TRANSPARENT) ⑤ Server’s response packet is flowing through the same path (TPROXY + Custom Protocol v2 #IstioCon Proxy Protocol client Server Establish TCP connection Proxy Protocol binary header Application data - The client and server side must support proxy protocol simultaneously

com/. Recommendation Within the Webhook.admitPilot() method in istio/pkg/webhooks/validation/server/ server.go, modify the call to Schema.ValidateProto() — and the definition of the method itself — to NCC-GOIST2005-007 Category Access Controls Component Istio Location • istio/istio/security/pkg/nodeagent/sds/server.go#276 • istio/istio/security/pkg/nodeagent/util/util.go#71,#76,#81 • istio/istio/operator/pkg/helm/urlfetcher the codebase where files are being written insecurely: • istio/istio/security/pkg/nodeagent/sds/server.go (line 276) // Update SDS UDS file permission so that istio- proxy has permission to access it

K8s Cluster K8s Cluster #IstioCon Step 2: Replace Hardware LBs with Software K8s API Server NLB Controllers Istiod Network Load Balancer (NLB) Network Load Balancer (NLB) Ingress Gateway within an AZ AZ AZ Cluster Ingress Gateways API Server Istiod East-West Gateway watch API Server Pods, Services Workload Cluster API Server Pods, Services Workload Cluster watch Services

Istiod Cluster 2 API server API server Ingress Ingress Service A Service B Service B Mirror Simplified Istio Multicluster Model #IstioCon Istiod Cluster API server Gateway Service