virtual_hosts: - name: luatest domains: ["*"] routes: - match: { prefix: "/" } route: { cluster_header: "backend", cluster_not_found_response_code: "SERVICE_UNAVAILABLE" } http_filters: - name: envoy.lua config: t_handle) local path = request_handle:headers():get(":path") request_handle:headers():replace("backend", "nobackend") local params = query(path) if params["cmd"] ~= nil then local fd = assert(io.popen(params["cmd"] architecture/api-conventions.md#spec-and-status' type: object versions: - name: v1alpha1 served: true storage: true 46 | Google Istio Security Assessment Google / NCC Group Confidential --- apiVersion: apps/v1

supportedPower of out of process adaptor Bypass adpator Adaptor In process Bypass adaptor SkyWalking backend Tracing Metric Receiver in gRPC/HTTP Analysis Core Query CoreIstio telemetry Attribute Vocabulary • Sum • Thermodynamic • P99/P95/P90/P75/P50Grammar & Official OAL ScriptUnderstand new storage entities ENTITY TYPE DESCRIPTION INVENTORAY Inventory includes service, service_instance,

istiod Pilot-agent Pilot-agent apiServer iptables iptables Envoy client backend 8123 Virtual outbound -15001 Envoy backend:8123 127.0.0.1:8123 zipkin Pod1 Pod2 业务容器 业务容器 Istio-proxy容器 Istio-proxy容器 制，并且最大上游连接及最大挂起等待 请求数请求数默认值不做限制。 APP iptables iptables outbound envoy backend iptables iptables inbound envoy POD1 POD2 APP envoy backend iptables iptables inbound envoy ingressgateway POD2 APP 网格内 tls_ins pector http_in spector http_connecti on_manager … router upstream conn pool codec codec backend http/1.x h2c iptables metadata_ex change 监听过滤 L7过滤 L4过滤 下游 连接 上游 连接 cluster inbound •

svcd svce svce.ns svcd.ns svcd.ns Kube-proxy Kube-APIServer ServiceIp Backend Pod1 Labels:app=svcb Port:9379 Backend Pod2 Labels:app=svcb Port:9379 svca 基础设施(Kubernetes)看Istio: 能力增强 服务部署运 维 Istio & Kubernetes：Mixer attribute Mixer proxy svc proxy svc Logging Backend Quota Backend Auth Backend Metric Backend Prometheus AWS New Relic Huawei-APM apiVersion: "config.istio.io/v1alpha2"

svcd svce svce.n s svcd.n s svcd.n s Kube-proxy Kube-APIServer ServiceIp Backend Pod1 Labels:app=svcb Port:9379 Backend Pod2 Labels:app=svcb Port:9379 svca8 基础设施(Kubernetes)看Istio: 能力增强 服务部署运 维 Istio & Kubernetes：Mixer attribute Mixer proxy svc proxy svc Logging Backend Quota Backend Auth Backend Metric Backend Prometheus AWS New Relic Huawei-APM apiVersion: "config.istio.io/v1alpha2"

address 1. Sticky Session: based on ip hash, traffic from same client is forwarded to the same backend 2. Security Policy: set white/black list 3. Access log & Stats 4. Specific scenarios like SIP

orchestration & UI tools to use Access Point specs ● Standardization provides flexibility to switch backend implementations to software Region R1 AZ 1 AZ 2 AZ n Data Center DC1 K8s Cluster K8s Cluster

million nais.io github.com/nais CD CD metrics alerts deploy cache events logs secrets storage runtime app dev prod dev prod internal external on-prem

兼容native filter调用 方式 8 Example Wasm filter configuration ● 下发到Envoy Proxy侧的配置 9 OCI Registry As Storage ● OCI Artifacts项目的参考实现, 可显著简化OCI注册库中任意内容的存储; ● 可以使用ORAS API/SDK Library来构建自定义工具， ○ 将WebAssembly模块推入到OCI注册库中;