provide service-to-service communication, manages TLS certificates, provides workload identity, and includes a builtin authorization system facilitated by its control plane. The goal of the assessment was Istio (NOTE: Envoy itself was not part of the assessment). • Istio Control Plane: Istio operator, side car injector, and other Istio control plane services • Istio Documentation: The documentation and matched areas of code with specific security controls (e.g. service discovery, certificate lifecycle, side car injection) to focus testing efforts. Istio does not currently have a reference design for what

recommended MaxBytesHandler was used, the request body was not fully consumed, meaning that when a server attempts to read HTTP2 frames from the connection it will instead be reading the body. As such, the other components had practically been le� unaudited. There are pros and cons to this. On the positive side, it shows that the Istio maintainers have a clear understanding of which parts of Istio should be FuzzBuildSecurityCaller istio.io/istio/security/pkg/ server/ca https://github.com/istio/istio/blob/6 5478ea81272c0ceaab568974aff7 00aef907312/security/pkg/server/c a/authenticate/fuzz_test.go#L21 The fuzzers

cloud. They have common features, also have project specified feature. We provide a common platform includes all common features, connect all projects with istio. #IstioCon Common services are in core cluster two services, the client side and server side’s “envoy proxies” verify each other’s identities before sending requests. • If the verification is successful, then the client-side proxy encrypts the traffic traffic, and sends it to the server- side proxy. • The server-side proxy decrypts the traffic and forwards it locally to the actual destination service. #IstioCon Secure Platform – Authorization Policy

Request Cert (SDS)) 3. CSR Auth: JWT 4. Cert signed with SPIFFE format Istio-proxy CA server #IstioCon Istio identity – how to get configuration ● Format: "spiffe:///ns/server side mTLS mTLS in Istio - PeerAuthenticati on Using ingress port and ingress host to send request: peer-authentication only defines behavior of server side and auto-mTLS is on by default Access productpage 1) Apply peer-authentication to enable server side mTLS mTLS in Istio - PeerAuthenticati on

packet dest ip + port and forward it to POSTROUTING ④ send out to real server Note: Only one connection between user and real server #IstioCon HAPROXY- Transparent Transport ① user send traffic to haproxy connection ④ Loadbalancing: select a endpoint and init a connection to server with original user’s address (IP_TRANSPARENT) ⑤ Server’s response packet is flowing through the same path (TPROXY + Custom Protocol v2 #IstioCon Proxy Protocol client Server Establish TCP connection Proxy Protocol binary header Application data - The client and server side must support proxy protocol simultaneously -

Adopting Istio 43 Adoption challenges Adopting Istio ● Moving HTTP/2 load-balancing from client-side to Envoy ● Label selector updates for app and version labels ● Istio default retry policy ● Istio load-balancing from client-side to Envoy Adopting Istio ● We use gRPC heavily in our microservices ● But Kubernetes is pretty bad at load-balancing it ● So we solved it by using a client-side load-balancing library "connect-failure”, Connect-failure is retry-safe even for non-idempotent methods as it is triggers when a server is unavailable at the TCP level. Build your Istiod image, push your tag and use it in the IstioOperator

How to Manage AwesomeRPC Traffic in Istio? Pilot Envoy Code changes at the Pilot side: ● Add AwesomeRPC support in VirtualService API ● Generate LDS/RDS for Envoy Filter AwesomeRPC proxy in the outbound listener Replace TCP proxy in the inbound listener client Server v1 30% 70% Server v2 9090 9090 #IstioCon EnvoyFilter is Powerful, But ... It’s very difficult if

require client application restarts Challenges – Client certificates 7 • mTLS provided by Istio • Server certificate provided by Istio Proxy sidecar container • Each Kafka client request gets a client client certificate attached automatically by Istio Proxy sidecar container • Client certificate includes the K8s service account of the Kafka client application • SPIFE:///ns//sa/

0 码力 | 14 页 | 875.99 KB | 1 年前

3

SPRING CLOUD GATEWAY www.my-application.com 75% or Header: X-User-Type: Non-Admin RIBBON (Client-Side Load Balancer) 25% or Header: X-User-Type: Admin Service Instance V1 Service Instance V1 Service SPRING CLOUD GATEWAY www.my-application.com 75% or Header: X-User-Type: Non-Admin RIBBON (Client-Side Load Balancer) 25% or Header: X-User-Type: Admin Service Instance V1 Service Instance V1 Service Instance V2 Service Instance V2 Service Instance V2 Service Instance V2 RIBBON (Client-Side Load Balancer) Load Balancer Deployment Deployment Deployment Canary Releases Using Istio with

Official OAL ScriptUnderstand new storage entities ENTITY TYPE DESCRIPTION INVENTORAY Inventory includes service, service_instance, endpoint, network_address. They are metadata for SkyWalking. Don’t