Auto-mTLS in Istio ● Decide what type of traffic the client sidecar to send automatically ○ If DestinationRule is configured, respect it ○ If server has a sidecar and allows mTLS, send mTLS – reviews-v1 in Istio - Destination rule http http http http mTLS mTLS #IstioCon mTLS in Istio - DestinationRule Defines what type of traffic the client sidecar will send ● DISABLE: send plain text, common if you want to TLS with service outside mesh apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule metadata: name: reviews spec: host: reviews trafficPolicy: tls: mode: ISTIO_MUTUAL

attacker that is able to intercept raw network connections between Envoy proxies and upstream DestinationRule targets can perform a man-in-the-middle attack against clients whose TLS-configured DestinationRules GitHub repository’s issue #25652,12 as part of its process to generate Envoy configurations from DestinationRule policies, Istio translates the Destina- tionRule trafficPolicy.tls (ClientTLSSettings) field Google Istio Security Assessment Google / NCC Group Confidential Recommendation Update the DestinationRule documentation16 to provide a clear warning early on that the lack of a configured caCertificates

developers to consume this contract ● Prior knowledge of Istio ● Need to create VirtualService and DestinationRule before anything happens ● VirtualService evaluation order matters #IstioCon Checkpoint 1

Istio配置管理有局限性： • Endpoint的配置管理有防抖动处理，即使集群中的部署变化再快， 也不会阻塞Istio • Istio其他配置管理没有防抖动处理（ VirtualService/DestinationRule等），如果用程序自动化注入这些 配置要注意在客户端实现限流 • Istio的配置管理缺少兼容性设计，CRD无法做到平滑升级 • Istio的架构和基本原理 • FreeWheel的Istio实践

Deployment Deployment Label selector Istio Istio几种重要资源对象 • 入口资源对象 • VirtualService • DestinationRule • 重要属性 • HTTPRoute • HTTPMatchRequest • TCPRoute • DestinationWeight { "uri": { "prefix":

Deployment Deployment Label selector Istio25 Istio几种重要资源对象 • 入口资源对象 – VirtualService – DestinationRule • 重要属性 • HTTPRoute • HTTPMatchRequest • TCPRoute • DestinationWeight26 { "uri": { "prefix":

... destinationRules: - apiVersion: networking.istio.io/v1beta1 kind: DestinationRule spec: ... ... serviceEntries: - apiVersion: networking