#IstioCon Istio-redirector: the way to go to manage thousands of HTTP redirections Etienne Fontaine (@etifontaine) #IstioCon Istio-redirector 301-redirection from /bus/routes/bruxelles/lille [...] spec: gateways: - istio-system/istio-ingressgateway hosts: - www.blablacar.fr http: - match: - uri: exact: /co2 redirect: uri: /blablalife/lp/zeroemptyseats

erd、Traefic。Envoy由于高性能和扩展能力前在数据面遥 遥领先。 • Iptables使Pod间出入应用的流量均由Envoy代理，对应用来说完全透明。支持主要常用网路协议 Http1/Http2/Tls/gRPC/Tcp等。 Copyright © Huawei Technologies Co., Ltd. All rights reserved. Page 6 Envoy原理及总体架构-启动 用于原始目标服务，并找到后端处理器处理新连接。 • 后端处理器在配置中指定处理协议，根据协议相关的网络过滤器处理读取到的数据。 • 如果为http协议，再经过请求过滤器处理http协议头部，如路由选择等功能并创建上游连接池 • 将修改及编码后的http消息通过网络发送到对端Envoy的容器网络。 • Iptables识别为入流量则进入virtualInbound端口。 • ORIGINA 之后Connection对象再次向libevent注册Read/Write回 调onFileEvent，并作为L4层过滤管理器处理 onNewConnection，onData数据接收。 • 对于HTTP协议，将继续经过L7层编解码处理后向上游发 送请求。 • 当请求处理完毕后，将调用deferredDelete删除请求对象 并记录统计观测数据。 • 使用异步I/O方式发送网络数据，降低对线程内其他操作

NewHandler in an http.MaxBytesHandler.” John found that when the recommended MaxBytesHandler was used, the request body was not fully consumed, meaning that when a server attempts to read HTTP2 frames from from the connection it will instead be reading the body. As such, the MaxBytesHandler introduces an http request smuggling attack vector. The issue was disclosed to the Golang security team who fixed the slice controlled by potentially untrusted file size Low High Yes 5 Possible memory exhaustions in http utilities Low Medium Yes 6 Istio skips certificate verification Low High Yes 7 Unhandled errors

istio sidecar （ kubectl label namespace default istio-injection=disabled/enabled ） http http http http http http http Result: can access reviews-v1, reviews-v2 and reviews-v3 Access productpage peer-authentication to enable server side mTLS mTLS in Istio - PeerAuthenticati on mTLS http http http http mTLS http #IstioCon Auto-mTLS in Istio ● Decide what type of traffic the client sidecar to productpage 1) Apply destination rule enable client side mTLS mTLS in Istio - Destination rule http http http http mTLS mTLS #IstioCon mTLS in Istio - DestinationRule Defines what type of traffic the

Today 1. DNS query httpbin.ns1.svc.cluster.local 2. DNS response – 10.4.4.4 http req to 10.4.4.4 GET /status/200 http req to 172.16.1.3 GET /status/200 httpbin.ns1.svc.cluster.local SVC IP: 10.4 name servers. Envoy does not use the agent’s DNS cache. http req to 10.4.4.4 GET /status/200 httpbin.ns1.svc.cluster.local SVC IP: 10.4.4.4 http req to 172.16.1.3 GET /status/200 #IstioCon V1.8 Smart Performance Limitations: Solutions ● Software techniques ○ (eBPF-based) TCP/IP stack bypass ○ HTTP/3 & QUIC ● Hardware acceleration technologies ○ SRIOV/DPDK ○ Networking/Security offloading ●

Original Address Preserve Background Demo 1. HTTP Original Address Preserve #IstioCon Content 1. TCP Original Address Preserve Background Demo 1. HTTP Original Address Preserve #IstioCon What is transparent mode, two connections  L4 • Add IP in TCP Protocol options • Proxy Protocol  L7 • HTTP header “x-forwarded-for” • User Protocol #IstioCon LVS ① user send traffic to LVS ② PREROUTING per-connection basis which of the two versions is present. - Proxy Protocol Transport Socket #IstioCon HTTP XFF x-forwarded-for (XFF) is a standard proxy header which indicates the IP addresses that a request

的基础上增加了 VirtualInboundListener，VirtualOutboundListener、OutboundCluster、InboundCluster 等 概念。 为何按端口对 HTTP 的处理进行聚合，而不是为每一个服务创建一个 Listener？ • 降低 Listener 数量和配置大小，减少资源占用 • 兼容 headless 和虚机服务，避免 Listener 配置频繁更新 15001 0.0.0.0_ 15006 9 Istio 流量管理 – 数据面 – 端到端请求处理流程 以 Bookinfo 为例说明服务间 HTTP 调用的流量拦截及处理流程： 1. Productpage 发起对 reviews 服务的调用：http://reviews:9080/reviews/0 。 2. 请求被 productpage Pod 的 iptables 出向流量规则拦截，处理后重定向到本地 listener 根据原目标 IP（通配）和端口（9080）转发到 0.0.0.0_9080 这个 outbound listener。 5. 根据 0.0.0.0_9080 listener 的 http_connection_manager filter 配置，该请求采用 9080 route 进行分发。 6. 9080 这个 route 的配置中，host name 为 reviews:9080

Filter Filter Cluster Upstrea m Filter Chain 扩展自定义Filter, 并通过xDS API动态配置 L4 Network Filters L7 Http Filters 3 Listener & Filters before outbound services Listener Downst ream Filter Filter Filter Filter Chain 4 实际示例中用到的Envoy Filters 端口9080 监听 envoy.filte rs.network .metadata _exchange envoy.http _connectio n_manage r Cluster Productp age服务 Filter Chain envoy.filters.ht tp.wasm/envo y.wasm [productpage-xxx] -c istio-proxy curl localhost:15000/config_dump envoy.filters .http.cors envoy.filters .http.fault envoy.filters .http.router envoy.filters.ht tp.wasm/envo y.wasm.stats envoy.filters.ht tp

NoSQL We need to manage multiple types of layer-7 traffic in a service mesh, not just HTTP and gRPC ● RPC：HTTP, gRPC, Thrift, Dubbo, Proprietary RPC Protocol … ● Messaging: Kafka, RabbitMQ … ● Cache: requet level ○ HTTP host/header/url/method, ○ Thrift service name/method name ○ Dubbo Interface/method/attachment ○ ... ● Fault Injection with application layer error codes ○ HTTP status code ○ ○ ... ● Observability with application layer metrics ○ HTTP status code ○ Thrift request latency ○ ... ● Application layer security ○ HTTP JWT Auth ○ Redis Auth ○ ... IP Data IP Header TCP

Istio Security Assessment Google / NCC Group Confidential - "*" gateways: - test/bookinfo-gateway http: - match: - uri: exact: /productpage route: - destination: host: details.restrict-test.svc.cluster the following 7. Run the following command and observe that a normal HTML page is returned curl -v "http://$GATEWAY/productpage" 8. Use an administrative account to run the following commands kubectl -n commands curl -v "http://$GATEWAY/productpage" curl -v "http://$GATEWAY/login" 10. Observe that the first command now returns a 404 error and the second command returns a redirect to http://www.nccgroup