Your laptop as part of the service mesh by Lorenzo Fundaró SRE @ Omio #IstioCon What’s on the menu today ● EnvoyFilter in practice ● Demo ● Inspiration #IstioCon Questions #istiocon @ istio

Service 1 Proxy Service 2 Proxy Namespace foo Istio authn & authz policies Namespace bar 2. Enforce k8s RBAC policies: roles bound to namespace, only mesh admins are allowed to have

Twitter, & VMWare ● Top contributors to Envoy and Istio ● Wrote Istio: Up and Running, NIST SPs 800-204A, NIST SP 800-204B Sheng Wu Creator, SkyWalking ● Tetrate’s product build on top of the upstream Certified Istio Admin, En https://academy.tetrate.io/ Tetrate Academy Warp up • We built products on top of the upstream Istio. • We aim to solve the complexity of Istio and build a zero-trust network for

transport protocol ● A little like TCP + TLS, but build on top of UDP ○ Uses UDP like TCP uses IP ○ Adds connections, resends and flow control on top ○ Provides independent streams ■ Extremely similar to

关。 • 非侵入服务网格最早为2016年Linkerd。 • 2017年，Goole、IBM、Lyft发布Istio。Istio目前为服务网格的事实标准，并且是2019年Github增长最快的TOP 10开源 项目之一。目前最新为1.10版本。 Copyright © Huawei Technologies Co., Ltd. All rights reserved. Page 5 Envoy介绍

layer applicable to so�ware applications. Istio is platform and language agnostic, but is o�en used on top of Kubernetes. It offers users easy access to features such as observability, traffic management and