## Taming Istio Configuration with Helm Ryan Michela / @ryanmichela / Salesforce IstioCon ## I n this talk This is a talk about using Helm with Istio Look at helm from a new perspective • Helm helps helps automate Istio day-2 tasks • Helm gitops ## HELM ## HELM The package manager for Kubernetes It's not just for installation anymore! ## HELM ## What is Helm? • Installer for Charts • Define need most of Helm to get the most from Helm! ## Managing Istio with Helm ## How does Helm relate to Istio? - Istio install built on Helm • Istio runs on YAML - Our services are installed with YAML

[Image](/uploads/documents/2/6/e/7/26e7ae12695c0e2584eb7f2157dc20c3/p2_7.jpg) Arriès de bus à Bruxelles et Lille Istio-redirector 301-redirection from /bus/routes/bruxelles/lille to /bus/routes/bruxelles-1/lille-3 ## How do we use Istio? Our infrastructure is deployed on GKE, with GCLB and Istio IngressGateway User | Google Cloud Load Balancer | Gateways | Web App --- | --- | --- | --- Istio VirtualService | [ [...] | | spec: | gateways: | - istio-system/istio-ingressgateway | hosts: | hosts: | - www.blablacar.fr | http: | http: | - match: | - uri: | exact: /co2 | redirect: | redirect: | uri: /blablalife/lp/zeroemptyseats

well as from applications in user space • Map type O HASHMAP O SOCKHASH: Hold socket as value Istio Meetup China  ## ebpf socket in SOCKHASH map and determine its destination socket ➢ Help functions: BPF_MSG_REDIRECT_HASH Istio Meetup China ## Work Flow of Acceleration ## • sock_ops ○ Capture socket in specific states and Outbound Acceleration  Istio Meetup China ## Envoy to Envoy Acceleration(same host) envoy socket local_ip: 10.0.0.3 local_port:

## Local Istio Development John Howard / @howardjohn / Google ## I stioCon ## Fully Cloud docker pull ## Fully Cloud  [Image](/uploads/documents/a/1/4/6/a146b4326a708f4d32d9ab286b21ab7e/p5_1.jpg) + Reproducible configuration with other developers and Istio tests Easy to setup bespoke clusters, including enabling alpha features and multicluster speed + No Istio dependency. Great for minimal Envoy bug reproductions Great for rapid iteration of Envoy options Very different from production environment May be challenging to reproduce Istio configurations

[Image](/uploads/documents/a/5/9/c/a59c70e237af7d1abccba9edbfb1edb2/p10_3.jpg) WEB AssemblyHub ## Simplified Istio Multicluster Model API server Istiod API server Istiod Service A ◇ Ingress Service B Mirror bug-report #IstioCon ## You Are Innovating Too Fast! #IstioCon ## I stio Feature Process Tracked at the Istio enhancements repository Checklist and approval required for feature promotions: Experimental-&g [Image](/uploads/documents/a/5/9/c/a59c70e237af7d1abccba9edbfb1edb2/p18_19.jpg) ## 2020 : Year of Istio Innovation Simplified installation Simplified control plane New extension Model Unified multicluster

## Experiences from running Istio in a k8s production environment Line Moseng @linemoseng Johnny Horvi ## /nciv// 5,2 million ## 2023 年10月15日   ## app ## ↓ Istio RBAC Kubernetes Network Policy ## naiscar ## Lessons learned ## What's next? ## @nais_io @linemoseng