stio As An ## API Gateway ## Discussion Flow • What is an API Gateway? • What is a Service Mesh? Common Features API Gateway + Service Mesh together! Istio as the API Gateway Advantages • Challenges Challenges • Where It Isn’t a Good Fit? ## What is an API Gateway? Service A Service B Service C  Service A Service B Service Deployment • Traffic Mirroring • Rate Limiting • TLS Termination Logging, Monitoring, Tracing ## API Gateway + Service Mesh together! ![Image](/uploads/documents/d/0/d/3/d0d3d2bc8b937de314f4192c01e9d77f/p14_1

## Apache APISIX from Gateway to Full Traffic Proxy with Istio Jintao Zhang API7.ai ## About Me • Apache APISIX PMC • Kubernetes Ingress NGINX maintainer • Microsoft MVP • zhangjintao@apache.org f5e/p2_1.jpg) ## Agenda • What is Apache APISIX • Why use Apache APISIX as the data plane for Istio • How to implement it . The future ## What is Apache APISIX ## Apache APISIX • ASF top level project 58c977891f5e/p5_1.jpg) https://github.com/apache/apisix Source Protocol ☑ Cloud-Native API Gateway APISIX 甲 HTTP2 gRPC HTTP(S) AI-Plane Tars Dubbo TCP UDP MQTT QUIC Monitoring Security

# Apache APISIX: How to implement plugin orchestration in API Gateway wenming@apache.org Apache APISIX VP ## Ming Wen 温铭 • Co-founder @ api7.ai • VP and PMC member, Apache APISIX • committer, Apache Introduction to Apache APISIX • Custom plugin development in API Gateway • Generate APISIX plugins automatically • The future of API Gateway  ## Apache APISIX • Cloud Native API Gateway (https://github.com/apache/apisix) • Cover all features of Nginx • Fully dynamic: routing, SSL certificates, upstream, plugins... - More

## 蚂蚁金服 API Gateway Mesh 思考与实践 靳文祥（花名：贾岛） 蚂蚁金服 高级技术专家 ## /01 API Gateway Mesh 的定义 ## /02 蚂蚁金服 API Gateway Mesh 实践 /03 云原生 API Gateway 的思考 ## API Gateway Mesh 的定义 ## Control Plane Traffic LB\Ingress LB\Ingress ## API Gateway Sidecar Sidecar App App POD POD K8S Cluster ## API Gateway ## V S 概念 Exposes your services as managed APIs 流量 南北流量（内外） 负载均衡 硬负载（LVS、Nginx） 通信协议 通用协议（HTTP、gRPC 等） 东西流量（内部） 软负载（服务发现） 私有协议（WS、Dubbo、Bolt 等） 一般不需要 基于 Service 路由 弱依赖（RBAC） 弱依赖 弱依赖 ## MQ Client API Gateway SofaRPC Service Code ## Sidecar Motorcycle (MOSN/Envoy) ## An infrastructure to expose your services

well as from applications in user space • Map type O HASHMAP O SOCKHASH: Hold socket as value Istio Meetup China  ## ebpf socket in SOCKHASH map and determine its destination socket ➢ Help functions: BPF_MSG_REDIRECT_HASH Istio Meetup China ## Work Flow of Acceleration ## • sock_ops ○ Capture socket in specific states and Outbound Acceleration  Istio Meetup China ## Envoy to Envoy Acceleration(same host) envoy socket local_ip: 10.0.0.3 local_port:

## Local Istio Development John Howard / @howardjohn / Google ## I stioCon ## Fully Cloud docker pull ## Fully Cloud  6b4326a708f4d32d9ab286b21ab7e/p5_1.jpg) + Reproducible configuration with other developers and Istio tests Easy to setup bespoke clusters, including enabling alpha features and multicluster Local resource speed + No Istio dependency. Great for minimal Envoy bug reproductions Great for rapid iteration of Envoy options Very different from production environment May be challenging to reproduce Istio configurations

[Image](/uploads/documents/a/5/9/c/a59c70e237af7d1abccba9edbfb1edb2/p10_3.jpg) WEB AssemblyHub ## Simplified Istio Multicluster Model API server Istiod API server Istiod Service A ◇ Ingress Service B Mirror db2/p11_1.jpg) ## I stio simplify VM onboarding API server VM Service Istiod VM Service Gateway VM Service Service A ## I stio Standardize APIs Adopt Kubernetes service API Protocol declaration bug-report #IstioCon ## You Are Innovating Too Fast! #IstioCon ## I stio Feature Process Tracked at the Istio enhancements repository Checklist and approval required for feature promotions: Experimental-&g

## Experiences from running Istio in a k8s production environment Line Moseng @linemoseng Johnny Horvi ## /nciv// 5,2 million ## 2023 年10月15日   ## app ## ↓ Istio RBAC Kubernetes Network Policy ## naiscar ## Lessons learned ## What's next? ## @nais_io @linemoseng

Google enlisted NCC Group to perform an assessment on the open-source version of Istio and all of its components. Istio is a modern service mesh technology stack often used within Kubernetes clusters to facilitated by its control plane. The goal of the assessment was to identify security issues related to the Istio code base, highlight high risk configurations commonly used by administrators, and provide perspective partnership with Google's Istio subject matter experts. ## Scope NCC Group's evaluation of Istio included: - Istio Architecture: The overall design and architecture of Istio as it is deployed within

Service Mesh Meetup #4 上海站 2018.11.25 Observability And Istio Telemetry 吴晟 Apache SkyWalking Creator Apache ShardingSphere Co-founder Microsoft MVP Tetrate founding Engineer Bitmain tech expert tensions/v1beta1/namespace/istio-system/deployments/istio-policy| |source.workload.uid|string|Unique identifier of the source workload.|istio://istio-system/workloads/istio-policy| |source.workload.name|string|Source name|string|Source workload name.|istio-policy| https://istio.io/docs/reference/config/policy-and-telemetry/attribute-vocabulary/ # Metric settings in Istio bypass adaptor # instance for template metric