AuthorizationPolicy metadata: name: require-jwt namespace: istio-system spec: action: ALLOW rules: - from: - source: requestPrincipals: ["testing@secure.istio.io/testing@sec ure.istio "productpage-viewer" namespace: default spec: selector: matchLabels: app: productpage rules: - to: - operation: methods: ["GET"] apiVersion: "security.istio.io/v1beta1" kind: name: "details-viewer" namespace: default spec: selector: matchLabels: app: details rules: - from: - source: principals: ["cluster.local/ns/default/sa/bookinfo-productpage"]

configuration: settings: compression/case/method: zstd ● Zoned deployment, Affinity rules ● AntiAffinity rules ● Service templates Operator Administration: ClickHouse defaults Можно собрать желаемую

Logical Plan Logical Plan Optimized Logical Plan Physical Plan Program API Analysis rules Optimization rules: MATCH -> pushdown Planning Strategies Graph Execution Code Gen JIT Cost model Storage

• Cons • O(N^2) in control plane / O(N) in data plane • Poor in scheduling algorithm • Iptables rules are difficult to debug IPVS mode • Services are organized in hash table • IPVS DNAT • conntrack/iptables

CallingConv.h • Don’t throw exceptions across the boundary. Explicitly state/document memory ownership rules. • Consider accepting memory alloc/dealloc callbacks – recall previous recommendation. • Limit implicit

order of dynamic initializations  ❌  Static variables with constant initializers  ✔  Complex rules  Non-trivial for a reader to know whether it’s constant initialization or dynamic initialization