Apparmor and seccomp Docker profiles enabled by default when possible. Leverage is tioctl to make the decision about whether the environment supports these features or not. Further document the option to use this value to 0 is effective at restricting access from a Pod’s container to its sidecar, consider making this a hardened configuration item. If it’s necessary, provide guidance on how best to restrict this

documentation on upgrades across all supported methods ○ Test documentation using istio.io test framework #IstioCon Upgrade Working Group - User Experience ● Add pre-checks to identify and warn about stable ● Ensuring appropriate documentation, testing, and code completion is done for each level ● Making sure that features continue to mature #IstioCon Release Maturity ● Provide a consistent list of

effort intensive Solution • Comprehensive comparison of results • ML-driven identification of decision rules • Human review to accept the learned rules • No code! Test data | CONFIDENTIAL 18

Stabilizing Istio Both options have their drawbacks, since you need to involve users in the calculation, making it a big blocker in spreading the Istio adoption… The other big problem is estimating what is the abstractions to maximize the added value of Istio to our users: ● Automating the onboarding ● Making a feature fully automated and managed It improves by a lot: ● The user experience for developing

Tetrate, HP and others Intel Huawei Huawei IBM China Dev Lab # live viewers 554 432 395 381 341 291 Making Istio accessible 13 Sessions presented in Chinese 51 sessions presented in English 3 Workshops

Red Hat Google Soloio Participants 73 53 46 40 Satisfaction score 4.44/5 4.28/5 4.65/5 4.58/5 Making Istio accessible 12 Sessions presented in Chinese, transmitted also on Bilibili platform. 51

and provides aggregated data of Knative Service ready duration. o Knative Performance Testing Framework 2 Design #IstioCon o Ingress gateway MEM has linear growth, and it consumes ~=750k for 1 Knative

service from the standpoint of Istio. Visit Github to get more information https://github.com/aeraki-framework/aeraki #IstioCon Aeraki Configuration Example: Dubbo Service definition Traffic rules #IstioCon

breaker • Fault injection • Telemetry collecting Pilot 将通用协议路由规则解析为统一格式 的 xDS 配置下发。 RPC Filter Framework Awesome RPC Specific Logic Decoding/encoding Parsing header …… Routing …… 优点： • 控制面的扩展性好 问题： • 需要修改

Istio: 1. Peer authentication: used for service-to-service authentication to verify the client making the connection. 2. Request authentication: Used for end-user authentication to verify the credential