handles service discovery. • Istio Ingress/Egress: Networking controls allowing inbound and outbound access of Istio services. • Istio Envoy Usage: The configuration and implemen- tation of Envoy within Istio issues 4 Medium issues 5 Low issues 7 Informational issues 2 Total issues 18 Category Breakdown Access Controls 7 Configuration 5 Cryptography 1 Data Exposure 3 Data Validation 2 Component Breakdown when all the security features are enabled, there does not appear to be a way to restrict a Pod’s access to them. Attempts to modify the settings to “controlPlaneAuth Policy: MUTUAL_TLS” did not appear

com/istio/istio/blob/6 5478ea81272c0ceaab568974aff7 00aef907312/pkg/bootstrap/fuzz_t est.go#L26 2 FuzzRunTemplate istio.io/istio/pkg/kube/inje ct https://github.com/istio/istio/blob/6 5478ea81272c0ceaab568974aff7 com/istio/istio/blob/6 5478ea81272c0ceaab568974aff7 00aef907312/security/pkg/k8s/chir on/fuzz_test.go#L22 4 FuzzIstioCASign istio.io/istio/security/pkg/ pki/ca https://github.com/istio/istio/blob/6 5478ea81272c0ceaab568974aff7 go#L24 5 FuzzValidateCSR istio.io/istio/security/pkg/ pki/ra https://github.com/istio/istio/blob/6 5478ea81272c0ceaab568974aff7 00aef907312/security/pkg/pki/ra/fu zz_test.go#L23 9 Istio Security Audit, 2023

V0.2 Mesh Expansion (cont.) ● Traffic flow (VM -> Container) 1. Dnsmasq accepts DNS queries 2. Access the built-in Kube DNS (exposed by ILB) 3. Obtain the Cluster IP resolved 4. Traffic intercepted create a ServiceEntry (to select specific workloads) #IstioCon What Else Did Not Solve? ● VM access to K8s services ○ needs convoluted workarounds ○ exposes security risks ● External TCP services support for workload certificate attributes #IstioCon Security & Usability Limitations (cont.) ● Access management: CNI needs improvements ○ Much required to avoid escalated Pod privileges ○ No support

[2021-02-09T06:29:10.489Z] "GET /v1/xx/xx/xx/xx HTTP/1.1" 503 UF "-" "-" 0 91 288 - "100.95.165.3" “xx-xx" "513cca39-1ea7-47db- 8c04-a5827464ce22" "100.85.225.193" "10.17.10.181:xx" outbound|xx|191130102|xx.xx.svc.cluster • 运行期日志 • Accesslog：格式 https://www.envoyproxy.io/docs/envoy/latest/configuration/observability/access_log/usage • 调试日志：pilot-agent request POST /logging?connection=trace #Cxxx • 抓包 • 进入pod容器网络空间执行

ds to be more than the sum of all sleeps in the preStop hooks. ➔ If the pod is terminated too early, connection draining may not complete, leading to 5xx errors Example: for sleep 30 + sleep 45 in Kubernetes and Envoy ● Be patient and resisting the temptations from users to open features too early ● Mechanisms to improve the reliability of Istio 30 Choose your fights, start small Stabilizing

mesh ● Everyone says to fail fast and retry quickly, but... ● How fast to timeout? ○ If it’s too early then failed the request for no reason. ○ If it’s too late then the calling client might be left hanging

Maintenance ○ Upgrades ○ Debugging https://istio.io/latest/blog/2020/tradewinds-2020/ #IstioCon Early adopter vs Maintainer ● Consumes latest & greatest Istio ● Utilize new capabilities ● Desire

benefits (#releases, #rollbacks, MTTR, #bugs-in-production, Reduced eng effort for testing, velocity) – Early testing of services components auto-generated from end-to-end tests – Significantly reduced time

istio-injection=disabled/enabled ） http http http http http http http Result: can access reviews-v1, reviews-v2 and reviews-v3 Access productpage #IstioCon Istio Identity Istiod Istio Agent Envoy 1. Start to send request: can access reviews-v1, reviews-v2 and reviews-v3 can reach v2 as peer-authentication only defines behavior of server side and auto-mTLS is on by default Access productpage 1) Apply and ingress host to send request: can access reviews-v1, reviews-v3 can not access reviews-v2 since we have enabled ISTIO_MUTUAL mode on client side Access productpage 1) Apply destination rule

with Istio multi-cluster - Replicated control planes Some standalone cluster without Istio can access core cluster also, as tenant. HP Horizon Platform Connect With Istio #IstioCon Secure Platform service. #IstioCon Secure Platform – Authorization Policy Using Authorization Policy enables access control on workloads in the mesh. For request from ingressgateway, need verify token For request Version 1 : Istio Mixer authz adapt Implement role-based authorization – whether this user can access this api based on its role => Version 2: Envoyfilter ext_authz #IstioCon Wise Platform #IstioCon