name: reviews-route spec: hosts: - reviews.prod.svc.cluster.local awesomeRPC: - name: ”canary-route" match: - headers: user: exact: jason route: - destination: host: reviews.prod.svc.cluster.local subset: svc.cluster.local", "reviews" ], "routes": [ { "name": ”canary-route" "match": { "headers": [ { "name": ":user", "exact_match": "jason" } ], }, "route": { "cluster": "outbound|9080||reviews.default.svc reviews-route spec: hosts: - reviews.prod.svc.cluster.local protocol: awesomeRPC - name: ”canary-route" - match: attributes: - user: exact: jason route: - destination: host: reviews.prod.svc.cluster.local subset:

could be build a self- hosted checklist of features and configuration options that Istio believes match security best practices. See Appendix B on page 40. 2 | Google Istio Security Assessment Google / gateways: - test/bookinfo-gateway http: - match: - uri: exact: /productpage route: - destination: host: details.restrict-test.svc.cluster.local port: number: 9080 - match: - uri: exact: /login redirect: expressions is one method of doing accomplishing this. If data is found by the code that does not match expectations, raise an error. 35 | Google Istio Security Assessment Google / NCC Group Confidential

request_handle:headers():get("x-devroute") 3 if string.match(contract, "foo") == nil then 4 return 5 end #IstioCon 6 -- we have a contract match 7 address = contract[“foo”] 8 headers =

apiVersion: … kind: VirtualService metadata: name: ratings-route spec: hosts: - svcb http: - match: - headers: cookie: exact: “group=dev” route: - destination: name: v1 - route: - destination: “reviews-route” }, “spec”: { “hosts”: [ "reviews" ], “gateways”: [ "bookinfo", "mesh" ], “http”: [ { "match": [ { "headers": { "cookie": { "regex": "^(.*?;)?(user=jason)(;.*)?" } }, "uri": { "prefix":

Pilot apiVersion: … kind: VirtualService metadata: name: ratings-route spec: hosts: - svcb http: - match: - headers: cookie: exact: “group=dev” route: - destination: name: v1 - route: - destination: “reviews-route” }, “spec”: { “hosts”: [ "reviews" ], “gateways”: [ "bookinfo", "mesh" ], “http”: [ { "match": [ { "headers": { "cookie": { "regex": "^(.*?;)?(user=jason)(;.*)?" } }, "uri": { "prefix":

networking.istio.io/v1alpha3 kind: EnvoyFilter metadata: …. spec: configPatches: - applyTo: HTTP_FILTER match: …. patch: …. workloadSelector: labels: app: productpage version: v1 19 生成的Istio Envoy Filter资源(2) networking.istio.io/v1alpha3 kind: EnvoyFilter metadata: …. spec: configPatches: - applyTo: HTTP_FILTER match: …. patch: …. workloadSelector: labels: app: productpage version: v1 20 更新后的Deployment - 以hostpath方式挂载wasm

gateways: - istio-system/istio-ingressgateway hosts: - www.blablacar.fr http: - match: - uri: exact: /co2 redirect: uri: /blablalife/lp/zeroemptyseats

Platform K8s custom resource definition HTTP filters Network filters UDP listener filters … Match outbound listeners in all sidecars Or Istio gateway The Lua code that Envoy will execute. Which

Configure mocks with Istio virtual service Route requests to mock svc with a virtual service - match: - uri: prefix: /reviews rewrite: uri: /api/ms/CubeCorp/MovieInfo/test/reviews/reviews

safety ○ Tracing, security ○ Networking ● Hooks ○ sock_ops ■ Construct map​ ○ sk_msg_md ■ Match & redirect ● ~5% improvements #IstioCon TCP/IP Stack Bypass (cont.) ● Leverage eBPF ● Target