settings of the IstioOperator API • demo: enables a variety of extra features • empty: provides a template • minimal: minimal config to get an operational deployment • preview: enables experimental features init container defined within istio/manifests/charts/istio-control/ istio-discovery/files/injection-template.yaml that is injected into Pods when CNI is not enabled for Istio Impact In the event of a compromise include control over the container image used, the configuration file to use, the configuration template to use, and the ability to arbitrarily control volume mounts for the sidecar container. These directly

replicas: 2 template: metadata: labels: app: rating version: v1 spec: containers: - image: rating-v1 ... --- kind: Deployment metadata: name: rating-v2 spec: replicas: 3 template: metadata:

spec: replicas: 2 template: metadata: labels: app: rating version: v1 spec: containers: - image: rating- v1 kind: Deployment metadata: name: rating-v2 spec: replicas: 3 template: metadata: labels:

动建立master连接，需要管理额外的kubeconfig • Sidecar内的服务流量默认是不被劫持的，如果需要劫持需要添加额 外的annotation 扩展Mixer接入授权 • 右图为Mixer的基本原理，Template 是对Proxy上报的Attribute的特定处 理机制的框架，支持四类： • Preprocess: 汇总流量相关元数据 和环境（k8s）相关的元数据 • Report: 上报数据

2018 08:12:19 GMT","780", • "bc1f172f-b8e3-4ec0-a070-f2f6de38a24f","718"]转换成属性词汇异步Flush到Adapter ü通过Template润色数据 ü使用Go的协程异步Flush到Adapter üAdapter展示数据 ü响应envoy数据处理完成问题讨论 Report流程回顾 üEnvoy异步批量发送数据给Mixer

以hostpath方式挂载wasm filter文件到Proxy容器 apiVersion: extensions/v1beta1 kind: Deployment metadata: .… spec: …. template: metadata: annotations: sidecar.istio.io/userVolume: '[{"name":"wasmfilters- dir","hostPath":{

istio-validation is introduced. o We can remove the istio-validation container by modifying the injection template. Mitigations: o When adding new worker node, make sure daemonset pod of istio CNI plugin is up

connects with a valid identity token ● All we have to do is ○ specify a new WorkloadGroup with a template (to create WorkloadEntry) ○ create a ServiceEntry (to select specific workloads) #IstioCon What

handle the Sidecar CRD Policy and GitOps CI/CD pipeline to apply them ● We are exploring Cuelang to template a simple DSL for managing various features ○ Full Istio onboarding (lifecycles, injection…) ○