Surfaces Istio is both a collection of security controls and an attack target. Workload Cluster Edge Operations Workload Data Exfiltration Man-In-The-Middle Denial of Service Privilege Escalation architecture Cluster Workload Edge Operations Ingress Policies Egress Policies WAF / IDS Firewall User AuthN/Z Data Loss Prevention Certificate Authority K8s Network Policy K8s RBAC Audit Completeness Service mesh security best practices 2 Cluster security Edge security Workload security Operation security Mesh security Edge Security Cluster security Service Proxy Ingress 1

operational agility ● You can't be Cloud Native at scale without a modern application- aware network Cloud!=Cloud Native Bare metal VMs Kubernetes VMs ● Monolith was decoupled to Microservices ● sit at the application edge and are used in multi-cluster environments to route traffic between clusters hosting the same application. ● Tier-2 Gateways sit at the cluster edge and route traffic to the Envoy ● Multi Cluster support ● XCP Central -> XCP Edge TSB Control Plane ● VM integration ● XCP Edge ● Upstream Istio ● XCP Central -> Edge ● TSB CR -> Istio CR TSB Config Data Flow Cluster Onboarding

to lift and shift ● Packaged software ○ Non-Linux ○ unikernels ● Domain specific workloads ○ Network Functions (NFV) #IstioCon Hybrid and Multi Clouds #IstioCon Istio VM Integration is? A Tumultuous about connecting virtual machine workloads to Kubernetes workloads. #IstioCon VM Support – Single Network #IstioCon VM Support – Multiple Networks #IstioCon Current State of VM Support ● Traffic flow name resolved ■ gets routed through the gateway to the service ● The data plane traffic ■ Single network ● direct communication w/o requiring intermediate Gateway ■ Multiple networks ● all goes though

Developer(Security SIG), Istio Community, 2020-Present Anthos Service Mesh, Google Inc, 2020 Envoy is an edge and service proxy that allows traffic in an infrastructure to flow in a mesh, allowing you to visualize a pausing pod Kubelet invoke CNI plugins CNI plugins setup ip for pod Istio CNI install isidecar network routing rule to workload iptable Benefits of Istio CNI No need for CAP_NET_ADMIN and CAP_NET_RAW get started in here and bypassing istio sidecar proxy(race condition) Istio CNI install sidecar network routing rule to workload iptable Issue in Istio CNI Kubelet Start a pausing pod Kubelet invoke

categorization, see Appendix A on page 38. Title ID Risk Inability To Secure Control Plane Network Communications 004 High Lack of Security Related Documentation 016 High Lack of VirtualService Assessment Google / NCC Group Confidential Finding Details Finding Inability To Secure Control Plane Network Communications Risk High Impact: High, Exploitability: Medium Identifier NCC-GOIST2005-004 Category Istio should not have any plaintext endpoints exposed via its control plane and should enforce all network communications use mTLS (or at minimum, TLS) for communi- cations within the istio-system namespace

complements Istio with the robust features of Google Cloud's Apigee API management platform, Apigee Edge, by extending API management natively into the microservices stack Istio & Kubernetes 在Google： Knative

meant to deliver higher multi-Gbps peak data speeds, ultra low latency, more reliability, massive network capacity, increased availability, and a more uniform user experience to more users. Higher performance Authorization between CNFs 5 ©2021 Aspen Mesh. All rights reserved. 5G Network Function Decomposition Microservice Network Function Implementation 5G Architecture Looks a Lot Like a Mesh? 6 ©2021 Redis DB SMF App X https://aspenmesh.io/how-to-capture-packets-that-dont-exist/ Optical Tap Network Analyzer Encrypted traffic w/PFS Intra node traffic HTTP/2 awareness Contextual data 16 ©2021

Huawei Technologies Co., Ltd. All rights reserved. Page 15 Envoy过滤器架构 • 根据位置及作用类型，分为： • 监听过滤器（Network::ListenerFilter） • onAccept接收新连接，判断协议类型，TLS握手，HTTP协议自动识别、提取连接地址信息 • L4 网络过滤器 • HTTP、Mysql、Dub 前的目标服务地址，作为后续负载均衡的输入。 envoy.filters.network.tcp_proxy L4网络过滤器 基于L4层1对1上下游网络连接代理 envoy.filters.network.wasm L4网络过滤器 基于WASM（WebAssembly）技术，支持沙箱、热升级、 跨语言的扩展机制，处理L4层新连接、数据收发。 envoy.filters.network.dubbo_pro xy L4网络过滤器 RPC协议并提取请求中方法、接口、 metadata等信息，并根据元数据进行路由选择。 envoy.filters.network.local_rateli mit L4网络过滤器 基于L4层网络限流，通过令牌桶防止定期时间间隔内 过多下游连接。 envoy.filters.network.http_conne ction_manager L4网络过滤器 专门用于处理HTTP请求的网络过滤器，根据协议类型

proxies deployed as sidecars. The proxies consist of Envoy proxies and an Istio-agent and manage network traffic between microservices. The control plane is responsible for applying user configuration to in the hermetic part, because builds run with network access, while SLSA compliance requires no network access: “The build service… MUST prevent network access while running the build steps.” With regards

in the AZ ○ Shared-Nothing Architecture ■ Hosts services catering to the AZ, e.g., AZ IPAM, Network Load-balancers, etc. ■ Full isolation by confining service failures to AZ boundary AZ 1 AZ Replace Hardware LBs with Software K8s API Server NLB Controllers Istiod Network Load Balancer (NLB) Network Load Balancer (NLB) Ingress Gateway Ingress Gateway Pods Request Traffic Response