Sensitive Information 002 Medium Default Production Profile Not Sufficiently Hardened 003 Medium Weak Hash Used for Integrity 009 Medium Go Trace Profiling Enabled By Default 013 Medium Permissive Kubernetes ig-profiles/ 14 | Google Istio Security Assessment Google / NCC Group Confidential Finding Weak Hash Used for Integrity Risk Medium Impact: Medium, Exploitability: Low Identifier NCC-GOIST2005-009 instructions into the cluster. Description A cryptographic hash is a function which takes a string of bytes and returns a small, fixed-size value. Hash functions guarantee that the same input always results in the

Knowledge Prog type ● SOCK_OPS ➢ Set callbacks for TCP state changing ➢ Help functions: BPF_MAP_UPDATE_ELEM, BPF_SOCK_HASH_UPDATE ● SK_MSG ➢ Attach to a SOCKHASH map, capture the packets sent by a socket socket in SOCKHASH map and determine its destination socket ➢ Help functions: BPF_MSG_REDIRECT_HASH Istio Meetup China Work Flow of Acceleration ● sock_ops o Capture socket in specific states and

of Inbound, 4-tuple key may conflict due to same src/dst ip address #IstioCon Use pod ip as hash key Use pod_ip to generate a unique key is a way to distinguish socket from different network

Address Preserve #IstioCon What is the use case of original address 1. Sticky Session: based on ip hash, traffic from same client is forwarded to the same backend 2. Security Policy: set white/black list

implement common Security, Observability, Service Routing & Discovery functions as features of the infrastructure - ○ Functions: TLS Termination, Traffic Management, Tracing, Rate Limiting, Protocol

com/apache/incubator-skywalking/blob/master/docs/en/ concepts-and-designs/oal.md • Extendable Aggregation Functions • Aggregation Function • Count • Calls per minute • Avg response time • Sum • Thermodynamic

builds on Kubernetes and Istio to support deploying and serving of serverless applications and functions. http://www.servicemesher.com

and shift ● Packaged software ○ Non-Linux ○ unikernels ● Domain specific workloads ○ Network Functions (NFV) #IstioCon Hybrid and Multi Clouds #IstioCon Istio VM Integration is? A Tumultuous Odyssey…

communicates with Istiod to automate key and certificate rotation, like so: Istio-agent has two functions: 1. To receive SDS requests from Envoy and send certificate signing requests to the CA which typically