original user’s address (IP_TRANSPARENT) ⑤ Server’s response packet is flowing through the same path (TPROXY + Custom Route) #IstioCon TOA Address Caveats : install toa module in kernel #IstioCon Proxy 244.0.25 Dest: 127.0.0.1 Src：10.244.0.20 ① Setting annotation sidecar.istio.io/interceptionMode: TPROXY, istio will automatically set the original src filter and iptabels rules #IstioCon Preserve TCP listener.proxy_protocol“ in inbound listener. ② Setting annotation sidecar.istio.io/interceptionMode: TPROXY， this will set all the rules as inner cluster #IstioCon Content 1. TCP Original Address Preserve

Ø可扩展的事件驱动模型 Ø可扩展的路由/后端管理机制 Ø更好的吞吐量3 能力核心能力 1 网络处理 •网络编程接口 •链接管理 •事件机制 •Metrics 收集 •TCP 代理 •TLS 支持 •TProxy 支持 •平滑 reload •平滑版本升级 多协议 •SOFA RPC •HTTP 1.x (待优化) •HTTP 2 (待优化) •Dubbo (研发中) •HSF (研发中)

installed. Older versions of minikube are shipping a kernel configuration that is not compatible with the TPROXY requirements of Cilium >= 1.6.0. minikube version minikube version: v1.3.1 commit: ca60a424ce69 installed. Older versions of minikube are shipping a kernel configuration that is not compatible with the TPROXY requirements of Cilium >= 1.6.0. minikube version minikube version: v1.3.1 commit: ca60a424ce69 currently uses TPROXY iptables actions as well as socket matches. For L7 redirection to work as intended kernel configuration must include the following modules: CONFIG_NETFILTER_XT_TARGET_TPROXY=m CONFIG_

installed. Older versions of minikube are shipping a kernel configuration that is not compatible with the TPROXY requirements of Cilium >= 1.6.0. minikube version minikube version: v1.3.1 commit: ca60a424ce69 installed. Older versions of minikube are shipping a kernel configuration that is not compatible with the TPROXY requirements of Cilium >= 1.6.0. minikube version minikube version: v1.3.1 commit: ca60a424ce69 currently uses TPROXY iptables actions as well as socket matches. For L7 redirection to work as intended kernel configuration must include the following modules: CONFIG_NETFILTER_XT_TARGET_TPROXY=m CONFIG_

currently uses TPROXY iptables actions as well as socket matches. For L7 redirection to work as intended kernel configuration must include the following modules: CONFIG_NETFILTER_XT_TARGET_TPROXY=m CONFIG_ Masquerade packets from endpoints leaving the host with BPF instead of iptables --enable-bpf-tproxy Enable BPF-based proxy redirection, if support available images string nil installIptablesRules Configure whether to install iptables rules to allow for TPROXY (L7 proxy injection), iptables-based masquerading and compatibility with kube-proxy. bool true

installed. Older versions of minikube are shipping a kernel configuration that is not compatible with the TPROXY requirements of Cilium >= 1.6.0. minikube version minikube version: v1.3.1 commit: ca60a424ce69 currently uses TPROXY iptables actions as well as socket matches. For L7 redirection to work as intended kernel configuration must include the following modules: CONFIG_NETFILTER_XT_TARGET_TPROXY=m CONFIG_

currently uses TPROXY iptables actions as well as socket matches. For L7 redirection to work as intended kernel configuration must include the following modules: CONFIG_NETFILTER_XT_TARGET_TPROXY=m CONFIG_ Masquerade packets from endpoints leaving the host with BPF instead of iptables --enable-bpf-tproxy Enable BPF-based proxy redirection, if support available images string nil installIptablesRules Configure whether to install iptables rules to allow for TPROXY (L7 proxy injection), iptables-based masquerading and bool true Key Description Type Default compatibility

installed. Older versions of minikube are shipping a kernel configuration that is not compatible with the TPROXY requirements of Cilium >= 1.6.0. minikube version minikube version: v1.3.1 commit: ca60a424ce69 currently uses TPROXY iptables actions as well as socket matches. For L7 redirection to work as intended kernel configuration must include the following modules: CONFIG_NETFILTER_XT_TARGET_TPROXY=m CONFIG_

sidecar injec�on to setup the transparent proxy mode (TPROXY) as required by Cilium’s proxy filters: $ sed -e 's,#interceptionMode: .*,interceptionMode: TPROXY,' \ < ${ISTIO_HOME}/install/kubernetes/