9080 - match: - uri: exact: /login redirect: uri: / authority: www.nccgroup.com 6. Save the result of the following 7. Run the following command and observe that a normal HTML page is returned curl istio-ingressgateway, in the istio-sys tem namespace to handle requests for all namespaces. As a result of this, it is possible for Gateways in different namespaces to declare servers lists with colliding user or application would not be able to tell the difference between the legitimate and malicious files based on the hash. The following hash functions are not considered cryptographically secure and should

into memory before the Handler is called. To limit the memory consumed by this request, wrap the result of NewHandler in an http.MaxBytesHandler.” John found that when the recommended MaxBytesHandler exceed their trust boundaries including authentication bypass, reading sensitive information, writing files to the underlying file system, exploiting logical errors. The security components have limited functionality the file contents to a main.go file and run it with go run main.go. Careful: This will overwrite files on the system. 1 2 3 4 5 6 7 package main import ( "archive/tar" "bytes" "compress/gzip" "fmt"

Page /bus/routes/bruxelles/lille 1 2 AFTER /bus/routes/bruxelles-1/lille-3 #IstioCon And the result is ?????? Happy users: I will be automatically redirected to the new page instead of seeing an configuration Deploy to production 1 4 2 3 Istio-redirector takes the .csv files and generates the Istio VirtualService files. Then, it automatically creates the Pull Request on GitHub on on our csv Importing the file Generating the Istio configuration Deploy to production 1 2 3 4 The files are reviewed, merged and deployed! How does it work ? #IstioCon >26k redirections are now running

frequency ● Proxies are heavily CPU throttling and consuming CPU without traffic ● Envoy configuration files are > 100K Lines 33 A full mesh is utopian, know what you need only Stabilizing Istio In fact HTTP/2 load-balancing capabilities out-of-the-box ● We tried it as-is, with existing gRPC services ● Result: Weird 5XXs on upstream service pod rollout ● No matter how well our services handled graceful termination

private-key and certificate pairs • Private keys and certificates are stored in keystore and truststore files in JKS or PKCS12 or PEM format Challenges – Kafka broker SSL with client auth 5 • Certificate truststore regeneration • Broker pods need restarting to pick up the modified keystore and truststore files • May cause service degradation Challenges – Certificate renewal 6 • Client certificates has be

label namespace default istio-injection=disabled/enabled ） http http http http http http http Result: can access reviews-v1, reviews-v2 and reviews-v3 Access productpage #IstioCon Istio Identity istio-proxy curl localhost:15000/config_dump #IstioCon Istio identity – check configuration result ● Result: cert generated automatically with Istio identity 1) Apply peer-authentication to enable server

testing for microservices architectures with Istio – Fewer failures higher up the test pyramid as a result of improved API tests • Istio benefits – Venky / Prasad – point here • Demo • Questions 2 Structure independently - Updates to an API require updating corresponding Service and Component tests - As a result, teams would go for just E2E tests | CONFIDENTIAL 6 Teams often focus on End-to-End tests (besides

Service config. ● Hard to manage when having hundreds of services. #IstioCon Abstracting to proto files Annotations API definition Greeting service example #IstioCon Please Build System ● https://github

traffic in a configurable set of formats #IstioCon Excellent Observability - Access logs Log Files Parse Istio-proxy Log • Each API Access Count • Each API Fail Rate • Each API Latency Easy to

box and the pull request will merge. New System Release Notes #IstioCon Release Notes: As a result... ● Release notes are thought of up-front as part of changes, with context by the people who know