servers ○ GPUs #IstioCon Application Deployment: Cloud Layout ● Region: A metro region ● DC: One or more Data Centers in each Region ● AZ: One or more Availability Zones in each DC ○ Independent globe peering with the Internet closer to the customer ○ PoPs are mini AZs Region R1 AZ 1 AZ 2 AZ n Data Center DC1 Region Rn #IstioCon Application Deployment: Cloud Layout ● Multiple K8s Clusters HA ○ In all regions ○ In multiple AZs in each region ○ Capability to run all applications from a single region or AZ in a worst-case scenario Region R1 AZ 1 AZ 2 AZ n Data Center DC1 K8s Cluster

proxy in the outbound listener Replace TCP proxy in the inbound listener client Server v1 30% 70% Server v2 9090 9090 #IstioCon EnvoyFilter is Powerful, But ... It’s very difficult if 实现原理：控制面根据 consumer 和 provider 的地域属性为provider实例配置 不同的LB优先级，优先级的判断顺序如下： 1. 最高：相同 region，相同zone 2. 其次：相同 region，不同zone 3. 再次：不同 region #IstioCon Aeraki Demo: 地域感知负载均衡(Dubbo) 1. 在 dubbo: application 配置中为 Provider aeraki_meata_locality 自定义属性 2. 在 provider 的 deployment 中通过环境变量设置其所属地域 3. 在 consumer 的 deployment 中通过 label 声明其所处的 region 和 zone 4. 通过 dr 规则启用 locality load balancing https://docs.qq.com/doc/DVnlqUVB1ek1laFBQ #IstioCon

Visibility ✓ Traffic Shaping ✓ Latency ✓ Single Point of Failure Adoption Challenges ● Multi-region deployments ● Non-flat networks ● Multi-tenant configuration ● Management of Istio installation cluster registration ● Higher Level Logical Service for Developers ○ Multi-cluster Identity ○ Multi-region Endpoint ○ Istio config integrated with gitops deployment ○ Init modifications to prevent proxy

egress bandwidth ~2 PB/month #IstioCon Architecture Overview ● User traffic infrastructure - TW region, all 3 zones ● REST APIs for client traffic ● gRPC for inter-service traffic ● Around 100+ microservices Capability for service authentication and authorisation ● Improved Observability ● Extendable to multi-region setup #IstioCon Approach #IstioCon Rollout - Istio setup and Microservices ● Split rollout in

Square DC -> Cash App EKS Internal Presentation New in-mesh s2s Internal Presentation New cross-region s2s Internal Presentation

recommended MaxBytesHandler was used, the request body was not fully consumed, meaning that when a server attempts to read HTTP2 frames from the connection it will instead be reading the body. As such, the FuzzBuildSecurityCaller istio.io/istio/security/pkg/ server/ca https://github.com/istio/istio/blob/6 5478ea81272c0ceaab568974aff7 00aef907312/security/pkg/server/c a/authenticate/fuzz_test.go#L21 The fuzzers typically is Istiod. 2. To receive ADS requests from Envoy and forward these to the specified discovery server which typically is Istiod. Istiod handles certificate signing requests via the IstioCAServiceServer

Request Cert (SDS)) 3. CSR Auth: JWT 4. Cert signed with SPIFFE format Istio-proxy CA server #IstioCon Istio identity – how to get configuration ● Format: "spiffe:///ns/server side mTLS mTLS in Istio - PeerAuthenticati on Using ingress port and ingress host to send request: peer-authentication only defines behavior of server side and auto-mTLS is on by default Access productpage 1) Apply peer-authentication to enable server side mTLS mTLS in Istio - PeerAuthenticati

packet dest ip + port and forward it to POSTROUTING ④ send out to real server Note: Only one connection between user and real server #IstioCon HAPROXY- Transparent Transport ① user send traffic to haproxy connection ④ Loadbalancing: select a endpoint and init a connection to server with original user’s address (IP_TRANSPARENT) ⑤ Server’s response packet is flowing through the same path (TPROXY + Custom Protocol v2 #IstioCon Proxy Protocol client Server Establish TCP connection Proxy Protocol binary header Application data - The client and server side must support proxy protocol simultaneously

com/. Recommendation Within the Webhook.admitPilot() method in istio/pkg/webhooks/validation/server/ server.go, modify the call to Schema.ValidateProto() — and the definition of the method itself — to NCC-GOIST2005-007 Category Access Controls Component Istio Location • istio/istio/security/pkg/nodeagent/sds/server.go#276 • istio/istio/security/pkg/nodeagent/util/util.go#71,#76,#81 • istio/istio/operator/pkg/helm/urlfetcher the codebase where files are being written insecurely: • istio/istio/security/pkg/nodeagent/sds/server.go (line 276) // Update SDS UDS file permission so that istio- proxy has permission to access it

Istiod Cluster 2 API server API server Ingress Ingress Service A Service B Service B Mirror Simplified Istio Multicluster Model #IstioCon Istiod Cluster API server Gateway Service