Guide 24.2.ea. Page 10 of 1010. Workspace location Resetting your workspace Keyboard shortcuts Certificate management Configuration files Enterprise edition Lite edition Ultimate edition How to migrate (optional): Parameter Description CA Certificate Path to the Certificate Authority (CA) certificate. Client Certificate Path to the client's public key certificate. Client Private Key Path to the client's Path to the keystore file. Keystore Password Password for the keystore. Certificate hostname Expected hostname in the certificate. SSL Mode Desired security level for SSL. SSL Factory Provide SSLSocketFactory

language Toolbar customization Workspace location Resetting your workspace Keyboard shortcuts Certificate management Configuration files Enterprise edition Lite edition Ultimate edition How to migrate (optional): Parameter Description CA Certificate Path to the Certificate Authority (CA) certificate. Client Certificate Path to the client's public key certificate. Client Private Key Path to the client's Path to the keystore file. Keystore Password Password for the keystore. Certificate hostname Expected hostname in the certificate. SSL Mode Desired security level for SSL. SSL Factory Provide SSLSocketFactory

language Toolbar customization Workspace location Resetting your workspace Keyboard shortcuts Certificate management Configuration files Enterprise edition Lite edition Ultimate edition Team edition (optional): Parameter Description CA Certificate Path to the Certificate Authority (CA) certificate. Client Certificate Path to the client's public key certificate. Client Private Key Path to the client's Path to the keystore file. Keystore Password Password for the keystore. Certificate hostname Expected hostname in the certificate. SSL Mode Desired security level for SSL. SSL Factory Provide SSLSocketFactory

Ingress Policies Egress Policies WAF / IDS Firewall User AuthN/Z Data Loss Prevention Certificate Authority K8s Network Policy K8s RBAC Audit Logging Image Verification Admission Control

incremental_backups 76 snapshot_before_compaction 76 Security Properties 76 authenticator 76 authority 77 internode_encryption 77 keystore 77 keystore_password 77 truststore 77 truststore_password take effect. Option Default Value authenticator org.apache.cassandra.auth.AllowAllAuthenticator authority org.apache.cassandra.auth.AllowAllAuthority auto_bootstrap false broadcast_address same as listen_address distributions. They never provided actual security, and in their current state are only meant as examples. authority The default value disables user access control (all users can access all resources). To control

VM's mesh identity (certificate) ■ based on a platform-specific identity ■ w/o a platform-specific identity ● using a short-lived K8s service account token ● Automatic certificate rotation ● Validation Alternative opts ○ Current: Fetch and exchange a k8s token for a bootstrap certificate, then place that bootstrap certificate on the VM ■ Dependency on K8s API server ■ Requires creating an RBAC impersonation Limitations to audit (proactively secure) ● VM cert extensibility ○ No support for workload certificate attributes #IstioCon Security & Usability Limitations (cont.) ● Access management: CNI needs

mutual TLS (mTLS) Option to encrypt intra-CNF traffic via mTLS Autonomous PKI service for certificate lifecycle management at scale What Do You Get From Istio? Traffic Management Powerful ● Integrate with PKI minted Intermediate CA ● Enable ECC certificates ● Configure workload certificate TTLs ● Enable strict mutual TLS (mTLS) instead of auto ● Use dedicated egress gateways Tuning rights reserved. ● Istio architectural changes ● SPIFFE only certificates ● Configuring workload certificate TTLs ● RSA to ECC migration ● Missing www-authenticate header ● Tuning per-workload proxy concurrency

thousands of pages belonging to different departments and users with greatly differing levels of authority and expertise, it is important to understand who is able to do what on your site. Use permissions

students must complete the course evaluation form at the end of the last day in order to receive a certificate of completion. • Please provide any and all feedback regarding this course to: training@canonical