gaps in documentation include: • /docs/ops/best-practices/security/: This section only provides 2 general recommendations. Use namespaces for isolation (a contentious perspective) and configured third party services 27 | Google Istio Security Assessment Google / NCC Group Confidential Note: As with general direct Pod connections involving Istio, it may be necessary for the client to bind to 127.0.0.6 as init containers — for which container specs may be queried directly through Kubernetes APIs — in general, they would be no-less opaque than the implementations used by CNI providers. 18https://istio.i

This can lead to system resource exhaustion if a large byte buffer is read into memory. Case 1 A general Get function that makes an http request and reads the entire response into memory: https://github internal documentation that had been produced as part of the mitigation process. We then looked for public documentation related to the issues in the audit report. Finally we evaluated the affected code parts Logics auditors found some shortcomings in how the issues had been approached on the Istio side. In general, we found limited tracking, both internally and publicly. Upon request, the Istio team had little

#IstioCon Commits ● For anything larger or bug fixes, create an issue and ask around for opinions ● General Contributing Guide ● Contributing Documentation: https://istio.io/latest/about/contribute/ #IstioCon

Programming Languages - Java, Python, Go lang, Scala, etc. ● Running on variety of Hardware ○ General-purpose x86 servers ○ GPUs #IstioCon Application Deployment: Cloud Layout ● Region: A metro region

sha256WithRSAEncryption … Subject: Subject Public Key Info: Public Key Algorithm: id-ecPublicKey Public-Key: (256 bit) pub:

runtime app dev prod dev prod internal external on-prem dev prod public cloud gke dev prod dev prod internal external on-prem internet external internal DMZ

integration ● On-prem, AWS, Azure, GCP, OpenShift ● 10000+ core business apps ● Plan to move to public cloud in 18 months ● Using F5 to distribute traffic at the DMZ zone Solving the OSS Istio pain

that can host all of your cloud native workloads: https://www.ibm.com/cloud/code-engine ● Kperf, a public Knative benchmark tool helps everyone to understand the issue and accelerate the whole debug and