istio/istio/galley/pkg/config/source/kube/inmemory/kubesource.go#20 • istio/istio/mixer/adapter/prometheus/prometheus.go#24 • istio/istio/mixer/pkg/checkcache/keyShape.go Impact Malicious actors may be able resource: rt.ToResource(objMeta, schema, item, &pos), }, nil • istio/istio/mixer/adapter/prometheus/prometheus.go (line 24) func computeSha(m proto.Marshaler, log adapter.Logger) [sha1.Size]byte { ba

监控方案问题二：现有的系统能否完全满足需求 现有系统如何满足运维需求Istio现有的监控体系 指标监控 分布式追踪 日志系统Zipkin的架构图 Google Dapper Zipkin的实现EFK和Prometheus的架构图 DC1 DMZ Intranet Elascticsearch cluster APP logfile APP logfile APP logfile Kubernetes Kubernetes console APP logfile APP logfile APP logfile Kubernetes console search &analysis Prometheus TSDB基于请求和日志的关联性改进架构 A Agent B Agent C Agent Request(Transaction ID) A(application) Trasanctionid（CA

可以修改全局注入参数 作用于所有目标空间的 pod 证书更新 Envoy启动流程 Envoy控制面流量 Envoy数据面流量 ./etc/istio/proxy/XDS SDS xDS CSR Prometheus configmaps Copyright © Huawei Technologies Co., Ltd. All rights reserved. Page 7 Envoy原理及总体架构-说明 • 启动concurrency数目的工作线程 • 启动看门狗线程监控各个工作线程是否定期touch，否则SIGABRT杀掉线程 • 启动admin RESTful监听，处理运行状态输出，prometheus收集等请求 • 定期将工作线程内监控数据stat进行合并 • 定期刷新DNS信息，加速域名解析。 • 目标cluster内主机列表健康状态判断。 • worker线程： • 通过启

verify-install ● bug-report #IstioCon Maintaining Istio ● Deployments ○ IstioOperator ● Monitoring ○ Prometheus ○ Grafana ○ Zipkin or Jaeger ○ Kiali #IstioCon GetIstio #IstioCon Community discuss.istio

across clusters #IstioCon Rollout - Istio setup and Microservices ● Export metrics to central prometheus ● Outlier detection for better reliability ● Enable Zonal routing, zonal deployment and HPA

Operation GitOps Gatekeeper RBAC Audit log Metrics Security testing tools Security dashboard Prometheus Kiali Security Lifecycle Concepts Secure Monitor Enforce Verify Demo: mesh security lifecycle

Mixer proxy svc proxy svc Logging Backend Quota Backend Auth Backend Metric Backend Prometheus AWS New Relic Huawei-APM apiVersion: "config.istio.io/v1alpha2" kind: metric metadata: name:

Mixer proxy svc proxy svc Logging Backend Quota Backend Auth Backend Metric Backend Prometheus AWS New Relic Huawei-APM apiVersion: "config.istio.io/v1alpha2" kind: metric metadata: name:

Learning Platforms - Tensorflow, PyTorch, Jupyter Notebook, etc. ○ Central Logging & Tracing - Prometheus, ClickHouse, etc. ○ Messaging systems - Kafka, RabbitMQ, etc. ○ Programming Languages - Java