Key Findings • There was a lack of validation on the VirtualService Gateway fields that could allow route hijacking • In testing, it did not appear to be possible to secure the control plane either within a default cluster. • The Envoy Proxy admin port is exposed via the Istio sidecar and would allow a malicious workload to override or compromise their own Istio configuration. Strategic Recommendations reproduced. Description Istio VirtualServices define the sets of traffic routing rules to apply when a host is addressed. They support matching on various criteria including URI paths and header values and

automatically with Istio identity 1) Apply peer-authentication to enable server side mTLS mTLS in Istio - PeerAuthenticati on Using ingress port and ingress host to send request: can access reviews-v1, reviews-v2 reviews-v3 can reach v2 as peer-authentication only defines behavior of server side and auto-mTLS is on by default Access productpage 1) Apply peer-authentication to enable server side mTLS mTLS rule to enable client side mTLS mTLS in Istio - Destination rule Using ingress port and ingress host to send request: can access reviews-v1, reviews-v3 can not access reviews-v2 since we have enabled

support A/B testing, canary deployments, rate limiting, access control, encryption and end-to-end authentication. Istio itself is implemented in Go which shields the project from memory-unsafe implementation is that it offers a series of security features related to identity, policies, TLS encryption, authentication, authorization and internal auditing to enhance the security in the mesh. Istio's security components There are a number of ways an attacker would seek to exceed their trust boundaries including authentication bypass, reading sensitive information, writing files to the underlying file system, exploiting

Ingress Token exchange 1. Istio authentication and authorization policies for every service: mTLS to defend against data exfiltration; deny by default. Credential (token, cookie, etc) lifecycle Demo Only allow authorized images Security Lifecycle Concepts Secure Monitor Enforce Verify Demo: mesh security lifecycle Demo Only allow authorized images Only allow authorized exceptions Concepts Secure Monitor Enforce Verify Demo: mesh security lifecycle Demo Only allow authorized images Only allow authorized exceptions Disallow non-strict mTLS Security Lifecycle Concepts Secure

为了将基础设施的运维管理从应用代码中剥离，我们需要七层的流量管 理能力： ● Routing based on layer-7 header ○ Load balancing at requet level ○ HTTP host/header/url/method, ○ Thrift service name/method name ○ Dubbo Interface/method/attachment ○ .. ○ HTTP JWT Auth ○ Redis Auth ○ ... IP Data IP Header TCP Data TCP Header Layer-7 Header Data #IstioCon What Do We Get From Istio? IP Data IP Header TCP Data TCP Header Layer-7 under layer-7 ○ IP address ○ TCP Port ○ SNI ● Observability - only TCP metrics ○ TCP sent/received bytes ○ TCP opened/closed connections ● Security ○ Connection level authentication: mTLS ○ Connection

51ch62kjrnd.svc.cluster.local http: route: - destination: host: {revision-3}. 51ch62kjrnd.svc.cluster.local weight: 10 - destination: host: {revision-2}. 51ch62kjrnd.svc.cluster.local weight: 90 Knative enabled • mutual TLS is enabled to secure the user application traffic end to end in production • Allow platform to use Istio authorization policy to control the access to each Knative service based on scalability solution. o Activator needs to probe the service endpoint since it cannot access pods by IP directly. And it takes time for Istiod to discover the endpoint of ready pods and then push them

Gateway Virtual Service Destination Rule 外部请求 内部客户端 Service2 Service1 网格内部 定义网格入口 • 服务端口 • Host • TLS 配置 • 路由配置 • 根据 Host 路由 • 根据 Header • 根据 URI 路由 目的地流量策略配置 • LB 策略 • 连接池配置 • 断路器配置 • TLS 配置 Gateway External Envoy配置模型和xDS协议 ADS Server LDS RDS CDS EDS Envoy 配置模型的主要概念： • Downstream：连接到 Envoy 的下游 Host，发送请求并接收响应。 • Upstream： 上游 Host 接收来自 Envoy 的连接和请求，并返回响应。 • Listener：监听器是命名网地址（可以是TCP socket 或者 Unix domain socket)，可以被 Listener？ • 降低 Listener 数量和配置大小，减少资源占用 • 兼容 headless 和虚机服务，避免 Listener 配置频繁更新 • 采用七层 header 进行路由，请求原始目的 IP 不应影响路由结果 入向请求配置 出向请求配置 0.0.0.0_9080 0.0.0.0_15001 0.0.0.0_15006 Pilot (ADS Server) LDS RDS CDS EDS

balancing ● Improve performance and resilience ● Stricter zonal routing ● Capability for service authentication and authorisation ● Improved Observability ● Extendable to multi-region setup #IstioCon Approach ● Passthrough mode during rollout ● Service entry to connect internal proxy ● Kubernetes Cluster-IP services deployed across clusters #IstioCon Rollout - Istio setup and Microservices ● Export metrics gracefully (SIGINT, SIGTERM) ● Automate for easy management of setup across environments ● Ignore ports / IP as applicable - consul ● Namespace isolation helps reduce Istio proxy resources #IstioCon Next Steps

Virtual Machine Integration Odyssey, Jimmy Song #IstioCon V0.2 Mesh Expansion ● Prerequisites ○ IP connectivity to the endpoints in the mesh ○ Istio control plane services (Pilot, Mixer, CA) accessible Dnsmasq accepts DNS queries 2. Access the built-in Kube DNS (exposed by ILB) 3. Obtain the Cluster IP resolved 4. Traffic intercepted by the sidecar proxy 5. xDS ■ Traffic forwarded to ingress in the local SVC IP: 10.4.4.4 #IstioCon DNS Issues on VMs accessing K8s SVCs 1. DNS query for httpbin.ns1.svc.cluster.local 2. DNS response – no such host httpbin.ns1.svc.cluster.local SVC IP: 10.4.4.4

#IstioCon Accelerate Istio-CNI with ebpf Xu Yizhou & Guo Ruijing #IstioCon Agenda ● Istio-CNI ● tcp/ip stack overhead between sidecar and service ● Background knowledge of ebpf ● Acceleration for Inbound/Outbound/Envoy Tcp/ip stack overhead between sidecar and service Overhead sidecar traffic from 3 scopes ● Inbound ● Outbound ● Envoy to Envoy(same host) #IstioCon Dataflow After Acceleration(same host) In the case of Inbound, 4-tuple key may conflict due to same src/dst ip address #IstioCon Use pod ip as hash key Use pod_ip to generate a unique key is a way to distinguish socket from different