(Wasm) enhancements ○ APIs for adding custom Wasm extensions ○ Focus on Developer workflow ○ Discovery of Wasm extensions ● External AuthZ extensions ● Telemetry provider extension APIs https://istio

"name": "${NAMESPACE}-access", "namespace": "$NAMESPACE" }, "rules": [{ "apiGroups": [ "", "extensions", "apps", "networking.k8s.io", "networking.istio.io", "authentication.istio.io", "rbac.istio.io" - apiGroups: 44 | Google Istio Security Assessment Google / NCC Group Confidential - apps - extensions resources: - daemonsets - deployments - deployments/finalizers - ingresses - replicasets - statefulsets

app: productpage version: v1 20 更新后的Deployment - 以hostpath方式挂载wasm filter文件到Proxy容器 apiVersion: extensions/v1beta1 kind: Deployment metadata: .… spec: …. template: metadata: annotations: sidecar.istio

detection (reliability) etc. ■ Pervasive security (via mtls) ■ Extensibility (to cherry pick extensions) [1] Service Mesh use cases for Telco and Edge – Google, ServiceMeshCon NA 2020 Key Drivers [1]

启动入口点位于envoy项目 source/exe目录下 • proxy项目中主要提供metadata_exchange，stats 等必要WASM扩展 • envoy项目中过滤器插件主要位于 source/extensions/filters，listener目录包含监听 过滤器，network目录包含L4层网络过滤器，http 目录包含L7层HTTP过滤器 proxy envoy envoy静态 二进制

● Authentication ● Authorization ● Policy Enforcement Points (PEPs) ● A set of Envoy proxy extensions to manage telemetry and auditing Certificate management Alongside each Envoy proxy, an instance