subsequently exploit it. Contributors to 3rd party dependencies Istio uses open source 3rd party dependencies that may impact the security of Istio. Istio's dependencies may be used by malicious attackers to exceed similarly to contributors to Istio itself - seek to commit vulnerable code into the source tree of dependencies of Istio to subsequently exploit it. Untrusted users Istio will o�en be deployed with the purpose Authenticated ⛔ ⛔ ⛔ Provenance - Service generated ⛔ ⛔ ⛔ Provenance - Non-falsifiable ⛔ ⛔ Provenance - Dependencies complete ⛔ Provenance - Identifies artifact ⛔ ⛔ ⛔ ⛔ Provenance - Identifies builder ⛔ ⛔ ⛔ ⛔

previous API request • Context propagation rarely obvious Challenge • Dependencies require lot of time to code • Many dependencies in a test suite • Dependency maintenance is effort intensive Solution

The Sidecar CRD to save the mesh Stabilizing Istio Main drawback Services must know their dependencies, document and update them. If this wasn’t the case before, Istio may not feel welcoming to users generate Sidecar ● Use protocol specific traffic sniffing (i.e. gRPC call discovery) to find out dependencies ● eBPF magic to get service calls? We use the first approach currently as it is protocol-agnostic

(line 172) • istio/istio/mixer/pkg/perf/run.go (line 106) • istio/istio/tools/istio-iptables/pkg/dependencies/implementation.go (line 30) • istio/istio/cni/cmd/istio-cni/iptables.go (line 59) • istio/ist location().Path) cmd.Stdout = os.Stdout cmd.Stderr = os.Stderr • istio/istio/tools/istio-iptables/pkg/dependencies/implementation.go (line 30) func (r *RealDependencies) execute(cmd string, redirectStdout bool

Secure and Reliable: Wasm runs in isolated VM, can dynamically update w/o Envoy restarts, no hard dependencies or cascading failures Speed: Near native performance Sustainable: Eliminates need to recompile

● L4 Micro-segmentation Solution ○ Central Policy store capturing Application-to-Application dependencies ○ Controllers watch K8s clusters and translate policies into K8s NetworkPolicies to be enforced