#IstioCon Istio Architecture Connect, secure, control, and observe services. #IstioCon Security Architecture #IstioCon Bookinfo architecture without service mesh ● Reviews-v1 ○ doesn’t call signed with SPIFFE format Istio-proxy CA server #IstioCon Istio identity – how to get configuration ● Format: "spiffe:///ns//sa/” ● istioctl proxy-config exec -c istio-proxy curl localhost:15000/config_dump #IstioCon Istio identity – check configuration result ● Result: cert generated automatically with Istio identity 1) Apply peer-authentication

Microkernel Overview I. Background  https://en.wikipedia.org/wiki/Microkernel Security I. Background  Difference Between Microkernel and Monolithic Kernel: Source: https://www with usermode VMMs Source: https://sel4.systems/About/seL4-whitepaper.pdf 1.2.1.3 Provable Security I. Background  .  https://docs.sel4.systems/projects/l4v/ https://github the Renode emulator.  Installation … … III. Sparrow Development  an example of Configuration IV. Wrap-up  Rust is playing an more and more important role in HW-SW collaboration!

};f # WARNING: Don't try this! Things We Have Done 1. Hardware Isolation 2. Security Tools - SELinux, Seccomp, AppArmor, Capabilities, Cgroup 3. Intrusion Detection - Monitor suspicious nginx EOT Rust- VMM Demo Future Works • Extend Rust-VMM to support networking and storage • Security policy integration • Develop a new fully Rust-based runtime for edge computing • Support live migration

analysis Fraud & spam detection DDoS protection Application performance monitoring Logs & metrics Security events and logs. SIEM Analytics of corporate networks Telemetry Industrial monitoring Sensor data

run steady and persistent nodes for this platform? Two Major Problems ➔ End user drives, no security (or token fund) drives. ➔ Network is like a living creature, it will evolve – grow or die. The

need… • a Service Mesh, but to secure it I need… • an automated Certificate Authority, and for more security I need… • a Container scanning and monitoring service, and to monitor it more I need… • a Log Aggregation

"clickhouse.altinity.com/v1" kind: "ClickHouseInstallation" metadata: name: "demo-01" spec: configuration: clusters: - name: "demo" Здесь нет storage Еще вернемся к этому kubectl – наше всё "clickhouse.altinity.com/v1" kind: "ClickHouseInstallation" metadata: name: "demo-01" spec: configuration: clusters: - name: "demo" layout: shardsCount: 2 replicasCount: "clickhouse.altinity.com/v1" kind: "ClickHouseInstallation" metadata: name: "demo-01" spec: configuration: users: demo/password: secret demo/profile: default demo/networks/ip: "::/0"

O p s / 平 台 运 维 • I T / 基 础 设 施 • 测 试 / 安 全 团 队 持续测试 (Continuous Testing) 持续安全 (Continuous Security) 软件研发核心工程实践：交付工程 CI/CD 开发者实践 软件研发核心工程实践：全流程质量工程实践 - 持续测试 CT/ 持续安全 CS 协 同 特 点 ： • 流 程 可 定 义

personalization configuration is not supported. Worker HPA1 HPA2 … HPAn HPA1 HPAPlus-controller Worker HPA1 HPA2 … HPAn HPA1 1. HPA can be turned on/off separately 2. Support for separate configuration of

Excuses Not enough time No appropriate tools Agenda nativescript-dev-appium: Installation Configuration Demo Benefits Drawbacks Our Story Requirements Do not reinvent the wheel Not modify app