focus testing efforts. Istio does not currently have a reference design for what an ideal Kubernetes cluster with Istio running within it. Instead, NCC Group used various hosting options (i.e. Minikube, GKE controlPlaneSecuri ty configuration directive or other means. This left all default services exposed within the cluster. • The default istio profile that is labeled for produc- tion lacks many hardening controls and Pilot admin interface exposes unnecessary ser- vices and is accessible to anyone within a default cluster. • The Envoy Proxy admin port is exposed via the Istio sidecar and would allow a malicious workload

Istio's OSS-Fuzz integration 1 CVE found in Golang 1 vulnerability found that affected Googles managed Istio offering 11 issues found ● 5 system resource exhaustion ● 1 arbitrary file write ● 1 missing Issue 10 - “H2c handlers are uncapped” - was an interesting finding, in that it affected Googleʼs managed Istio offering, and it led to further investigation that revealed a vulnerability in Golang itself configured - used by some managed Istio offerings - which the vast majority of Istio's users do not have. For that reason, a CVE was not assigned this vulnerability. Some managed service providers were vulnerable

tenants. • Knative has knative-ingress-gateway for external access and knative-local-gateway for cluster local access. They use Istio gateway service istio-ingressgateway as its underlying service. Knative blue.51ch62kjrnd.svc.cluster.local http: route: - destination: host: {revision-3}. 51ch62kjrnd.svc.cluster.local weight: 10 - destination: host: {revision-2}. 51ch62kjrnd.svc.cluster.local weight: 90 Knative multiple shard k8s clusters, each cluster should support 1000 sequential (interval 5s) Knative service provisionings with route ready time <= 30s. Type Info K8s Cluster Capacity 12 nodes in 3 zones, 16

Tetrate’s product build on top of the upstream Istio ● Why not Istio OSS? ● Problems unsolved ○ Multi-cluster and VM (lower onboarding cost) ○ Enterprise team structure gap (Workspace, Tenants, etc) ○ UI&UX controls, across clusters ● High availability & resiliency enabling active-active deployments ● Cross cluster security policies & access control ● Unified telemetry and availability reporting ● Service discovery agility More About Multi Cluster ● Multi tenancy ● Resource hierarchy ● NGAC Two-tier Gateway ● Tier-1 Gateways sit at the application edge and are used in multi-cluster environments to route traffic

namespaces) ● 100K RPS at peak on API Gateway ● 1 main production Google Kubernetes Engine (GKE) cluster ● 12k+ pods ● 750+ nodes Istio at Mercari 7 Istio at Mercari Apr 2019 Started Istio PoC Istio proxy performance and capacity Adopting Istio Fact: If Istio is enabled in all pods in a cluster, for n pods, there are n sidecars ● Case 1: One size fits all (need to fit the biggest workload) value of Istio to our users: ● Automating the onboarding ● Making a feature fully automated and managed It improves by a lot: ● The user experience for developing services ● The maintainability of Istio

Principal Engineer Schedule Preview Ambient Mesh Made Simple 8:05 Welcome Keynote 7:30 Ambient As Managed Infra 9:25 Roadmap Update 9:35 Pre-Sail Checks 10:10 Fine Grained RBAC + NGAC 9:25 Schedule Preview boat? Upcoming Talks: Aperture - Load Management Meshery - WASM plugin management Argo - Multi-cluster orchestration JP Morgan SLO Generation Reflecting on the Value of Community Housekeeping • View

Deployment: Cloud Layout ● Multiple K8s Clusters in an AZ ○ Each K8s cluster ~ 200 - 5,000 nodes ○ Upto 100,000 Pods in a cluster ○ 10,000+ K8s services - including prod, pre-prod, staging, etc. scenario Region R1 AZ 1 AZ 2 AZ n Data Center DC1 K8s Cluster K8s Cluster K8s Cluster K8s Cluster K8s Cluster K8s Cluster Region Rn #IstioCon Application Specs Region R1 Application failures to AZ boundary AZ 1 AZ 2 AZ n Data Center DC1 K8s Cluster K8s Cluster K8s Cluster K8s Cluster K8s Cluster K8s Cluster AZ Control Plane AZ Control Plane AZ Control Plane

domain socket)，可以被 下游客户端连接。在 Envoy 中,Listener 可以绑定到端口上直接对外服务，也可以不绑 定到端口上，而是接收其他 listener 转发的请求。 • Cluster：集群是指 Envoy 连接的一组上游主机，集群中的主机是对等的，对外提供相 同的服务，组成了一个可以提供负载均衡和高可用的服务集群。Envoy 通过负载均衡 策略决定将请求路由到哪个集群成员。 协议的主要概念： • Listener Discovery Service (LDS) : 监听器发现服务。 • Route Discovery Service(RDS) : 路由发现服务。 • Cluster Discovery Service (CDS)： 集群发现服务。 • Endpoint Discovery Service (EDS) ：集群中的服务实例发现服务。 • Secret Discovery – 数据面 – Istio 中的 Envoy Sidecar 配置 Istio中的 Envoy Sidecar 配置： • Istio 通过 Listener、Route Config 和 Cluster 为 Mesh 中的 Envoy 生成了入向和出向两个不同方向的处理流程的配 置。 • 在 Envoy 的基础上增加了 VirtualInboundListener，VirtualOutboun

and Surfaces Istio is both a collection of security controls and an attack target. Workload Cluster Edge Operations Workload Data Exfiltration Man-In-The-Middle Denial of Service Privilege Escalation Escalation Application Compromise Control Plane Service mesh security architecture Cluster Workload Edge Operations Ingress Policies Egress Policies WAF / IDS Firewall User AuthN/Z Data Completeness Service mesh security best practices 2 Cluster security Edge security Workload security Operation security Mesh security Edge Security Cluster security Service Proxy Ingress 1

Technologies Co., Ltd. All rights reserved. Page 9 Envoy启动配置及xDS listener router upstream pool Envoy cluster istiod pilot-agent LDS RDS CDS EDS tls证书 管理 SDS CSR创建证书 stat tracing 支持采集或 主动上报 监控系统 过滤器 service.route.v3.RouteDiscoveryService/StreamRoutes CDS 上游cluster配置 POST /envoy.service.cluster.v3.ClusterDiscoveryService/StreamClusters EDS 上游cluster endpoint配置 POST /envoy.service.endpoint.v3.EndpointD • 启动admin RESTful监听，处理运行状态输出，prometheus收集等请求 • 定期将工作线程内监控数据stat进行合并 • 定期刷新DNS信息，加速域名解析。 • 目标cluster内主机列表健康状态判断。 • worker线程： • 通过启动配置参数concurrency指定，不支持动态调整。 • 启动virtualoutbound/virtualinbound网络