-mtls.yaml destinationrule.networking.istio.io/productpage created destinationrule.networking.istio.io/reviews created destinationrule.networking.istio.io/ratings created destinationrule.networking.istio 4.2.6. 双向 TLS 的变化 当使用带有特定工作负载 PeerAuthentication 策略的 mTLS 时，如果工作负载策略与命名空间/全局策略 不同，则需要一个对应的 DestinationRule 来允许流量。 auto mTLS 默认启用，但可以通过将 ServiceMeshControlPlane 资源中的 spec.security.dataPlane.automtls DestinationRules 进行服务间的正常通信。例如，将一个命名空间的 PeerAuthentication 设置为 STRICT 可能会阻止其他命名空间中的服务访问它们，除非 DestinationRule 为命名空间中的服务配置 TLS 模式。 有关 mTLS 的详情请参考 启用 mutual Transport Layer Security（mTLS） 1.11.4.4.2.6.1

Some container Istio Sidecar Proxy Istio Ingress Gateway Istio Egress Gateway @rytswd DestinationRule ServiceEntry Gateway VirtualService Some service outside of cluster Version 1 Version Some container Istio Sidecar Proxy Istio Ingress Gateway Istio Egress Gateway @rytswd DestinationRule ServiceEntry Gateway VirtualService Some service outside of cluster Version 1 Version Some container Istio Sidecar Proxy Istio Ingress Gateway Istio Egress Gateway @rytswd DestinationRule ServiceEntry Gateway VirtualService Some service outside of cluster Version 1 Version

about Redis 2. Create DestinationRule to configure TLS origination for Redis Demo time 1. Deploy the redis-client with a sidecar, however no ServiceEntry and no DestinationRule Expectation: Should fail fail when trying to connect over plain TCP 2. Create DestinationRule and ServiceEntry Expectation: Ability to connect over redis through unencrypted TLS

Auto-mTLS in Istio ● Decide what type of traffic the client sidecar to send automatically ○ If DestinationRule is configured, respect it ○ If server has a sidecar and allows mTLS, send mTLS – reviews-v1 in Istio - Destination rule http http http http mTLS mTLS #IstioCon mTLS in Istio - DestinationRule Defines what type of traffic the client sidecar will send ● DISABLE: send plain text, common if you want to TLS with service outside mesh apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule metadata: name: reviews spec: host: reviews trafficPolicy: tls: mode: ISTIO_MUTUAL

attacker that is able to intercept raw network connections between Envoy proxies and upstream DestinationRule targets can perform a man-in-the-middle attack against clients whose TLS-configured DestinationRules GitHub repository’s issue #25652,12 as part of its process to generate Envoy configurations from DestinationRule policies, Istio translates the Destina- tionRule trafficPolicy.tls (ClientTLSSettings) field Google Istio Security Assessment Google / NCC Group Confidential Recommendation Update the DestinationRule documentation16 to provide a clear warning early on that the lack of a configured caCertificates

通信方案，Istio的 方案证书管理流程由 Citadel , Citadel Agent , Pilot 协同完成  Pilot 负责 UDS 路径配置下发，用户通过 Policy CRD 和 DestinationRule 来决策需要给哪些 Sidecar 下发  Sidecar 收到SDS Config 后，然后以 JWT 格式封装身份信息（service account）向Citadel Agent请求证书 对于Server 端利用Istio 的Policy CRD 实现 Namespace + Service 粒度的开关控制  对于Client 端理想情况下，希望是通过Istio 的 DestinationRule 和 VirtualService 来控制。但由于相 关条件尚未具备，因此通过现有注册中心来控制 Client TLS 能力Service Mesh Sidecar 的TLS 生产级落地实践Service

monitoring loadBalancer L7 traffic outlierDetection service deployment gateway virtualservice destinationrule istio ingress operator service pod proxy proxy(envoy) pod helloworld-v1 helloworld-v2 pod listener router gateway: proxy virtualservice: proxy cluster destinationrule:
 proxy-helloworld 10 90 Think in Cloud . 北北京 监控系统 Kube-State-Metrics Kubernetes APIServer cAdvisor Node-Exporter

destination: host: reviews subset: v2 apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule metadata: name: my-destination-rule spec: host: my-svc trafficPolicy: loadBalancer: location: MESH_EXTERNAL resolution: DNS apiVersion: networking.istio.io/v1alpha3 kind: DestinationRule metadata: name: ext-res-dr spec: host: ext-svc.example.com trafficPolicy: tls:

developers to consume this contract ● Prior knowledge of Istio ● Need to create VirtualService and DestinationRule before anything happens ● VirtualService evaluation order matters #IstioCon Checkpoint 1

HorizontalPodAutoscaler ● PodDisruptionBudget ● ConfigMap ● ServiceAccount ● VirtualService ● DestinationRule ● ServiceEntry #IstioCon Helm Starters for Istio 2.6. It is easier to move a problem around