IstioMeetup 服务网格数据平面热升级技术分享 ServiceMesh Data-Plane Hot-Upgrade 阿里云服务网格团队 – 史泽寰 • 为什么需要服务网格数据面热升级 • 实现热升级 • 实践热升级 目录 Catalog 2 为什么需要服务网格数据面热升级 Why do we need Hot-Upgrade for ServiceMesh Data-Plane • 造成请求失败，影响业务质量 增加workload保持服务容量不变，应对大规模场景难以在扩容规模和操作便捷度上取 得令人满意的平衡 传统Sidecar升级方式的缺点 3 为什么需要服务网格数据面热升级 Why do we need Hot-Upgrade for ServiceMesh Data-Plane • 只替换/重启Sidecar • 替换/重启过程中进/出不会出现请求失败，连接失败 • 易于运维，可以控制升级策略 理想的Sidecar升级 envoyproxy.io/docs/envoy/latest/intro/arch_overview/operations/hot_restart https://blog.envoyproxy.io/envoy-hot-restart-1d16b14555b5 实现热升级 Implement Hot-Upgrade 6 • Sidecar生命周期管理能力 • 启动两个Sidecar，以进行Envoy热重启的排水流程两个实例并存的阶段

NET_ADMIN • Traffic failures due to init restarts (#16768) 2. Be careful with secrets rotation 1. Hot restarts for TCP-traffic 2. Root certificate reissue (#14516) 3. Istio Discovery overload (#25495)

S初始化成功，通知P停止监听新的链接并优雅关闭未完成的工作 • 5. 在P优雅关闭过程中，S会从共享内存中获取stats • 5. 到了时间S通知P自行关闭 • 6. S升级为P • 官方博客：Envoy hot restart什么时候会进行热重启？监控envoy ü获取非正常退出状态 ü抢救机制触发 ü抢救令牌减少一个（总共10个） ü在2(n-1) * 200毫秒后执行（为什么不立即执行） ü失败再次触发抢救机制

model of Istio to guide the security audit as well as future security audits. 2. Carry out a manual code audit for security issues. 3. Review the fixes for the issues found in an audit from 2020. 4. Review obtained in parts of code bases that receive less attention. Our assessment is that, not counting the Operator, Istio is a very well-maintained and secure project with a sound code base, well-established test coverage with little to no room for improvement. We identified a few APIs in security-critical code parts that would benefit from fuzzing and wrote fuzzers for these. In total, 6 fuzzers were written

its control plane. The goal of the assessment was to identify security issues related to the Istio code base, highlight high risk configurations commonly used by administrators, and provide perspective areas of focus for subsequent phases of the assessment. A test plan was created which matched areas of code with specific security controls (e.g. service discovery, certificate lifecycle, side car injection) architectures were used to provide testers with a way of validating that security expectations in the code were implemented when deployed. Each environment was deployed following Istio Documentation using

com/gracezhang1110, www.linkedin.com/in/gong-zhang-75560670/ Advisory Software Engineer of IBM Cloud Code Engine team focusing on Knative Serving and Istio, contributor of the Knative and Cloud Foundry com/in/yu-zhuang- 51915287/ Architect and Senior Software Engineer in IBM Cloud. Working on IBM Cloud Code Engine (Serverless platform), focusing on Knative, Istio, and Tekton, community, leading team to running, and managing serverless, cloud- native applications. It provides benefits: Focus on code Scale to zero Quick entry to serverless computing … … traffic management observability security

wizards of Stack Overflow. Bugs And Security ● Read this quick explanation on how to report bugs, in code or in documentation. ● The Istio security team responds rapidly to vulnerability reports. Read how Contributor ● The Istio Community README is the starting point for contributors who want to work on code, docs or other parts of Istio. ● You can access our trove of technical content and working documents the Value of Community Housekeeping • View the full IstioCon-VIRTUAL schedule • Abide by CNCF Code of Conduct • Use the official #IstioCon in your social conversations • Join #istiocon slack channel

API request • Context propagation rarely obvious Challenge • Dependencies require lot of time to code • Many dependencies in a test suite • Dependency maintenance is effort intensive Solution • ML-driven ML-driven identification of candidate relationships • Supervised system to accept true positives • No code! | CONFIDENTIAL 17 ML-assisted Assertion Rule Learning createOrder Response: Recording { results • ML-driven identification of decision rules • Human review to accept the learned rules • No code! Test data | CONFIDENTIAL 18 Summary: create different types of tests efficiently by learning

with application layer error codes ○ HTTP status code ○ Redis Get error ○ ... ● Observability with application layer metrics ○ HTTP status code ○ Thrift request latency ○ ... ● Application layer AwesomeRPC in Istio? #IstioCon How to Manage AwesomeRPC Traffic in Istio? Pilot Envoy Code changes at the Pilot side: ● Add AwesomeRPC support in VirtualService API ● Generate LDS/RDS for

service | "unknown" destination_version: destination.labels["version"] | "unknown" response_code: response.code | 200 Istio & Kubernetes: 总结 对于云原生应用，采用Kubernetes构建微服务部署和集群管理能力，采用 Istio构建服务治理能力，将逐渐成为应用微服务转型的标准配置。