allows to control the exposure of mesh configuration to a specific proxy, based on namespace or labels. apiVersion: networking.istio.io/v1beta1 kind: Sidecar metadata: name: default namespace: mercari-echo-jp-dev allows to control the exposure of mesh configuration to a specific proxy, based on namespace or labels. apiVersion: networking.istio.io/v1beta1 kind: Sidecar metadata: name: default namespace: mercari-echo-jp-dev Moving HTTP/2 load-balancing from client-side to Envoy ● Label selector updates for app and version labels ● Istio default retry policy ● Istio proxy performance and load testing ● Abstracting the Istio

app app apiVersion: "nais.io/v1alpha1" kind: "Application" metadata: name: app labels: team: pension spec: image: navikt/app:1 port: 8080 replicas: { min: 2, max: 4 } probes: consumer-a app apiVersion: "nais.io/v1alpha1" kind: "Application" metadata: name: app labels: team: pension spec: image: navikt/app:1 port: 8080 replicas: { min: 2, max: 4 } probes: servicerolebinding serviceentry apiVersion: "nais.io/v1alpha1" kind: "Application" metadata: name: app labels: team: pension spec: image: navikt/app:1 port: 8080 replicas: { min: 2, max: 4 } probes:

svce.ns svcd.ns svcd.ns Kube-proxy Kube-APIServer ServiceIp Backend Pod1 Labels:app=svcb Port:9379 Backend Pod2 Labels:app=svcb Port:9379 svca 基础设施(Kubernetes)看Istio: 能力增强 服务部署运 维 服务治理 • 调用链追踪 service | "unknown" source_version: source.labels["version"] | "unknown" destination_service: destination.service | "unknown" destination_version: destination.labels["version"] | "unknown" response_code: metadata: labels: app: rating version: v1 spec: containers: - image: rating-v1 ... --- kind: Deployment metadata: name: rating-v2 spec: replicas: 3 template: metadata: labels: app: rating

svce.n s svcd.n s svcd.n s Kube-proxy Kube-APIServer ServiceIp Backend Pod1 Labels:app=svcb Port:9379 Backend Pod2 Labels:app=svcb Port:9379 svca8 基础设施(Kubernetes)看Istio: 能力增强 服务部署运 维 服务治理 • 调用链追踪 service | "unknown" source_version: source.labels["version"] | "unknown" destination_service: destination.service | "unknown" destination_version: destination.labels["version"] | "unknown" response_code: template: metadata: labels: app: rating version: v1 spec: containers: - image: rating- v1 kind: Deployment metadata: name: rating-v2 spec: replicas: 3 template: metadata: labels: app: rating version:

sleep-restrict spec: replicas: 1 selector: matchLabels: app: sleep-restrict template: metadata: labels: app: sleep-restrict annotations: proxy.istio.io/config: |- customConfigFile: "/mnt/envoyconfig/envoy istio-operator spec: replicas: 1 selector: matchLabels: name: istio-operator template: metadata: labels: name: istio-operator spec: serviceAccountName: istio-operator containers: - name: istio-operator metadata: name: istio-operator labels: istio-operator-managed: Reconcile istio-injection: disabled --- apiVersion: v1 kind: Service metadata: namespace: istio-operator labels: name: istio-operator name:

metadata: …. spec: configPatches: - applyTo: HTTP_FILTER match: …. patch: …. workloadSelector: labels: app: productpage version: v1 19 生成的Istio Envoy Filter资源(2) apiVersion: networking.istio.io/v1alpha3 EnvoyFilter metadata: …. spec: configPatches: - applyTo: HTTP_FILTER match: …. patch: …. workloadSelector: labels: app: productpage version: v1 20 更新后的Deployment - 以hostpath方式挂载wasm filter文件到Proxy容器 apiVersion:

registry and discovery Service ServiceEntry K8s Pods labels: app: foo class: pod ServiceEntry selector: app: foo Istio Workload Entries labels: app: foo class: vm #IstioCon V1.6-1.8 Better VM Workload

--namespace bookinfo --image webassemblyhub.io/yuval/addheader-rust:v1 --cluster mgmt-cluster --labels app=ratings Extension Config Discovery Service EXTERNAL AUTH RATE LIMITING ROUTER UPSTREAM

1ecey.my-namespace source.ip ip_address Source workload instance IP address. 10.0.0.117 source.labels map[string, string] A map of key-value pairs attached to the source instance. version => v1