of different securty options and expand on edge cases that may have a security impact such as multi-cluster environments. • /docs/ops/common-problems/security-issues/: This section has a lot of good information Group could not find clear documentation on the following subjects: • Security implications of multi-cluster setups • Transport security expectations of control plane traffic • Disabling default services This means that all workloads from all namespaces within the cluster, adjacent clusters in a multi-cluster setup, and services in adjacent network segments are able to access this endpoint. When accessed

Discovery Restarts (#25495) 2. Proxy Probes (#26792) Further Steps • Multi-cluster Discovery for OCP & Kubernetes • Multi-cluster Service Topology • Cloud-Native Event Hub • Full Support for VM-Based

Tetrate’s product build on top of the upstream Istio ● Why not Istio OSS? ● Problems unsolved ○ Multi-cluster and VM (lower onboarding cost) ○ Enterprise team structure gap (Workspace, Tenants, etc) ○ UI&UX hierarchy ● NGAC Two-tier Gateway ● Tier-1 Gateways sit at the application edge and are used in multi-cluster environments to route traffic between clusters hosting the same application. ● Tier-2 Gateways

Install/Upgrade ○ Admiral cluster registration ● Higher Level Logical Service for Developers ○ Multi-cluster Identity ○ Multi-region Endpoint ○ Istio config integrated with gitops deployment ○ Init modifications

the boat? Upcoming Talks: Aperture - Load Management Meshery - WASM plugin management Argo - Multi-cluster orchestration JP Morgan SLO Generation Reflecting on the Value of Community Housekeeping

improvement areas ● Native Kubernetes API integration ○ Kubernetes Service APIs ○ Kubernetes Multi-cluster APIs ● Adopt & drive innovation in Envoy community ○ Delta xDS ○ HTTP2 tunnels https://istio

Infrastructure to build, push, share, deploy, debug Wasm into Istio service mesh Wasm Registry Multi-cluster management, orchestration of Wasm lifecycle 22 | Copyright © 2020 • https://solo.io • https://solo

Project runs as tenant, need control rights Solution cluster connect core cluster with Istio multi-cluster - Replicated control planes Some standalone cluster without Istio can access core cluster also

GTP) ● High speed data path (SR-IOV/DPDK) ● Customizing workload certificate attributes ● Multi-cluster/site visibility ● Deep packet inspection Going Beyond Istio 15 ©2021 Aspen Mesh. All rights