rict-test" namespace per the Istio cluster setup guide2 2. Obtain the output of the following command (run with administrative access) and use it below in place of $GATEWAY kubectl -n istio-system get redirect: uri: / authority: www.nccgroup.com 6. Save the result of the following 7. Run the following command and observe that a normal HTML page is returned curl -v "http://$GATEWAY/productpage" 8. Use an "http://$GATEWAY/productpage" curl -v "http://$GATEWAY/login" 10. Observe that the first command now returns a 404 error and the second command returns a redirect to http://www.nccgroup.com/. Recommendation Within the

lifecycle hook in the istio-proxy container manifest lifecycle: postStart: exec: command: - pilot-agent - wait Fortunately, it is handled automatically since Istio 1.8 by `preStop` lifecycle hook in the istio-proxy container manifest: lifecycle: preStop: exec: command: [“/bin/sh”, “-c”, “while [ $(netstat -plunt | grep tcp | grep -v envoy | wc -l | xargs) -ne 0 ]; container manifest: lifecycle: preStop: exec: command: ["/bin/sh", "-c", "sleep 30; wget -qO- --post-data '' localhost:15000/healthcheck/fail; sleep 45;

gateway via TLS terminating Using ingress host and secure ingress port to send request: From curl command: need attaching certificate file Access productpage 1) Generate client and server certificates Authorize ingress traffic via JWT https + JWT http http http mTLS mTLS Send request via curl command ： 1) Invalid token can not pass the gateway, only valid token does 2) Delete JWT authentication

Experiences from running Istio in a k8s production environment Line Moseng @linemoseng Johnny Horvi Norwegian Labour and Welfare Administration 5,2 million nais.io github.com/nais CD CD metrics

independent streams ■ Extremely similar to HTTP/2, but in transport layer ● Improvements ○ TCP head of line blocking ○ Faster handshakes ○ Earlier data ○ Connection-ID ○ More encryption, always [1] Http3

u启动envoy u热重启envoy u监控envoy u优雅关闭envoy启动envoy ü监听/etc/certs目录 ü生成envoy静态配置文件envoy-rev0.json ü通过exec.Command启动 envoy并监听状态 • 文件配置文档 • 启动参数文档热重启envoy热重启涉及以下步骤 • Pilot-Agent只是负责启动S，其他步骤由envoy完成。 • 1. 启动另外一个S进程（Secondary