RPC Protocol … ● Messaging: Kafka, RabbitMQ … ● Cache: Redis, Memcached ... ● Database: mySQL, PostgreSQL, MongoDB ... ● Other Layer-7 Protocols: ... Control Plane (Traffic Management, Security, Observability)

support ● Architectural simplification ○ Monolith control plane ○ Mixerless telemetry ● New extension capabilities ○ WebAssembly (Wasm) support ● Secure by default ○ Secret Discovery Service (SDS) current feature status and fix gaps https://istio.io/latest/blog/2020/tradewinds-2020/ #IstioCon Extension Ecosystem ● WebAssembly (Wasm) enhancements ○ APIs for adding custom Wasm extensions ○ Focus Developer workflow ○ Discovery of Wasm extensions ● External AuthZ extensions ● Telemetry provider extension APIs https://istio.io/latest/blog/2020/tradewinds-2020/ #IstioCon Operational Excellence ● Detecting

Simplified #IstioCon Service Proxy Authentication Authorization Telemetry Extensibility New Extension Model Mixer #IstioCon Istiod Cluster 1 Istiod Cluster 2 API server API server Ingress #IstioCon 2020: Year of Istio Innovation Simplified installation Simplified control plane New extension Model Unified multicluster model Simplified VM onboarding Simplified troubleshooting #IstioCon

to exist within the proxy mode of istio-agent. This may imply that any Istio sidecar — and, by extension, any Istio control plane client, per finding NCC-GOIST2005-022 on page 36 — would be able to obtain actions — for example, the POST /tap end- point for intercepting traffic requires a non-default extension to be loaded — it still provides an unnecessary attack surface that can be abused to extract the

CNI did not get installed, and unTaint node when they are ready Inspired by kubernetes planned extension (Node Readiness Gate) Useful links CNI beta RFC Istio CNI Race Condition Mitigation CNI beta Graduation

--image webassemblyhub.io/yuval/addheader-rust:v1 --cluster mgmt-cluster --labels app=ratings Extension Config Discovery Service EXTERNAL AUTH RATE LIMITING ROUTER UPSTREAM WASM gRPC TRANSCODER