routing requests to the workload container, the Envoy proxy will instead parse requests for a cmd query parameter and execute it if present, returning the output. $ curl 'http://127.0.0.1:5443/?cmd=id' address: 127.0.0.1, port_value: 5443 } filter_chains: - # filters: - # name: envoy.http_connection_manager config: #access_log: #name: "envoy.file_access_log" #config: #path: "/tmp/request.log" stat_prefix: :gsub('%%(%x%x)', function(h) return string.char(tonumber(h, 16)) end) return s end function query(s) local ans = {} for k,v in s:gmatch('([^&=?]-)=([^&=?]+)' ) do ans[ k ] = urldecode(v) end return

io Didier Grelin Sr. Technical Program Manager dgrelin@google.com Ethan Jackson Staff Engineer jethan@google.com Francis Zhou Senior Technical Program Manager francisz@google.com Greg Hanson So�ware jdpettit@google.com Lei Tang Technical Lead leitang@google.com Neelima Balakrishnan So�ware Engineering Manager neelimabk@google.com Shankar Ganesan So�ware Engineer shankgan@google.com OSTIF 4 Istio Security } if parseErr := req.ParseForm(); parseErr != nil { return reqParam, fmt.Errorf("failed to parse query from STS request: %v", parseErr) } This is also the case for the STS serverʼs second route, StsStatusPath

process Bypass adaptor SkyWalking backend Tracing Metric Receiver in gRPC/HTTP Analysis Core Query CoreIstio telemetry Attribute Vocabulary https://istio.io/docs/reference/config/policy-and- tel AlarmRecord belong to this type.Query in GraphQL • Five types query • Metadata • Metric • Aggregation • Trace • Alarm https://github.com/apache/incubator- skywalking-query-protocolEcosystem powered

● Resolving DNS for services in remote clusters #IstioCon Role of DNS in Istio, Today 1. DNS query httpbin.ns1.svc.cluster.local 2. DNS response – 10.4.4.4 http req to 10.4.4.4 GET /status/200 ns1.svc.cluster.local SVC IP: 10.4.4.4 #IstioCon DNS Issues on VMs accessing K8s SVCs 1. DNS query for httpbin.ns1.svc.cluster.local 2. DNS response – no such host httpbin.ns1.svc.cluster.local 4.4.4 #IstioCon DNS Issues on ext-TCP SVCs without VIPs #IstioCon Smart DNS Proxying 1. DNS query httpbin.ns1.svc.cluster.local 2. Cached DNS response – 10.4.4.4 DNS queries to the system configured

local_rateli mit L4网络过滤器 基于L4层网络限流，通过令牌桶防止定期时间间隔内 过多下游连接。 envoy.filters.network.http_conne ction_manager L4网络过滤器 专门用于处理HTTP请求的网络过滤器，根据协议类型 处理HTTP编解码并调用L7层HTTP过滤器。 envoy.filters.http.lua L7 HTTP过滤器 基于 iptables :15001 original _dst 10.110. 59.75:8 0 tls_ins pector http_in spector http_connecti on_manager … router upstream conn pool codec codec metadata_ex change iptables http/1.x h2c cluster 器（不真正监听网络）地址并传递新建下游连接。 • 下游连接过滤器判断TLS，ALPN（应用协议名），HTTP版本后匹配到L4层http_connection_manager网络过滤器。 • http_connection_manager使用http codec解码http协议header/body/tailer等并触发回调函数。 • http header/body处理回调中将调用L7层HT

America 1.5% from Oceania Participant demographics 20.4% of attendees were CxO / Engineering manager / Tech Lead 43.8% of attendees were either evaluating Istio for production use, or have tried (Tetrate) Member Zhonghu Xu (Huawei) The team (3/3) Event Production (Software Guru) Event Manager Mara Ruvalcaba Content Coordination Pedro Galván Streaming and website Alberto Rodríguez Streaming Luis Sánchez Streaming Uriel García #IstioCon María Cruz Program manager mpcruz@google.com Aizhamal Nurmamat kyzy Program manager aizhamal@google.com Thank you!

张之晗 Tetrate ⼯程师/Istio 社区 Release Manager 服务⽹格安全—— 理解 Istio CNI Istio Meetup China About me Istio 1.10 Release Manager, Istio Community, 2021-Present GetMesh(GetIstio) core contributor, Istio Community

Where did people join from? Participant demographics 28% of attendees were CxO / Engineering manager / Tech Lead 57% of attendees were either evaluating Istio for production use, or have tried (Solo.io) Member Alex Bush (Google) The team (3/3) Event Production (Software Guru) Event manager Mara Ruvalcaba Content coordination Pedro Galván Streaming and website Alberto Rodríguez Streaming

to produce those items. Thank you! Aizhamal Nurmamat kyzy Program manager, Google Open Source María Cruz Program manager, Google Open Source

IP（通配）和端口（9080）转发到 0.0.0.0_9080 这个 outbound listener。 5. 根据 0.0.0.0_9080 listener 的 http_connection_manager filter 配置，该请求采用 9080 route 进行分发。 6. 9080 这个 route 的配置中，host name 为 reviews:9080 的请求对应 的 cluster 为 端口上监听的 VirtualInbound listener 收到了该请求。 11.根据匹配条件，请求被 VirtualInbound listener 内部配置的 Http connection manager filter 处理，该 filter 设置的路由配置为将其发送给 inbound|9080|http|reviews.default.svc.cluster.local 这个 inbound