and other Istio control plane services • Istio Documentation: The documentation and secu- rity guides hosted on istio.io. NCC Group started the assessment with an overall architecture review which extrapolated variety of tools often used for debugging (including sudo) which are not necessary for Istio’s operations: RUN apt-get update && \ apt-get install --no-install-recommends -y \ ca-certificates \ curl administrative interface. 9https://www.envoyproxy.io/docs/envoy/latest/operations/admin 10https://www.envoyproxy.io/docs/envoy/latest/operations/admin#post--quitquitquit 11https://www.envoyproxy.io/docs/envo

ask around, and share your ideas ● Join the Working Group ● Contributing ○ Check out the style guides for documentation ○ Look into writing tests and how they work ○ We are here to help you with your

Upgrade Survey 2020 #IstioCon Theme for Istio 2021 #IstioCon Day 2 operations https://dzone.com/articles/defining-day-2-operations #IstioCon What does it mean for our users? ● Project maturity ○ predictability ● Longer support windows ● Skip releases for upgrades #IstioCon Focus areas for ‘Day 2 Operations’ #IstioCon Stability & Maintainability ● Improved upgrade experience ○ Upgrade Working Group

Istio is both a collection of security controls and an attack target. Workload Cluster Edge Operations Workload Data Exfiltration Man-In-The-Middle Denial of Service Privilege Escalation Application Application Compromise Control Plane Service mesh security architecture Cluster Workload Edge Operations Ingress Policies Egress Policies WAF / IDS Firewall User AuthN/Z Data Loss Prevention

排水结束后旧实例退出，热重启完成 References: https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/operations/hot_restart https://blog.envoyproxy.io/envoy-hot-restart-1d16b14555b5 实现热升级 Implement Hot-Upgrade