Version 1.1 Prepared for Arun Kumar R Prepared by Mark Manning Jeff Dileo Divya Natesan Andy Olsen Feedback on this project? https://my.nccgroup.com/feedback/67b627f7-a0a2-43b7-ad68-af515a9ed2e0 Executive com/istio/istio – 7353c84b560fd469123611476314e4aee553611d • github.com/istio/proxy – c51fe751a17441b5ab3f5487c37e129e44eec823 • github.com/istio/istio.io – 26dacdde40968a37ba9eaa864d40e45051ec5448 Key Findings istio/proxy Istio Envoy Proxy code in the master branch up to July 15th, 2020. Commit: c51fe751a17441b5ab3f5487c37e129e44eec823 istio/istio.io Istio documentation and security guidelines from the master branch

https://github.com/istio/istio/blob/6 5478ea81272c0ceaab568974aff7 00aef907312/security/pkg/pki/ca/f uzz_test.go#L24 5 FuzzValidateCSR istio.io/istio/security/pkg/ pki/ra https://github.com/istio/istio/blob/6 81 82 83 84 85 86 87 88 89 90 func (f *URLFetcher) Fetch() error { if _, _, err := URLToDirname(f.url); err != nil { return err } saved, err := DownloadTo(f.url, f.destDirRoot) if err != nil { return err := os.Open(saved) if err != nil { return err } defer reader.Close() return tgz.Extract(reader, f.destDirRoot) } Case 2 This will run out of memory before disk space. See issue 5 case 1. 92 // DownloadTo

Third-party apps Manual QA trace: r trace: r trace: r trace: r CI Pipeline | CONFIDENTIAL 9 Process flow using Istio Deploy Lua filters (kubectl apply -f ) Capture traces for E2E apply -f Capture using Lua filter All API data + TraceIDs | CONFIDENTIAL 11 Assemble API request traces Service A Proxy Proxy Service B Service C Proxy req req[A B], trace:r, span:s1 span:s1 res[A B], trace:r, span:s1 req[B C], trace: r, parent_span: s1 res[B C], trace: r, parent_span: s1 req req[A->B] req[B->C] Construct request trace | CONFIDENTIAL

Training and Certification Collaboration with NIST ● Author SP 800-204 series on microservice security ● R&D on Next Generation Access Control (NGAC) ● Exclusively co-host annual zero trust multi-cloud conference Azure, GCP, OpenShift ● 10000+ core business apps ● Plan to move to public cloud in 18 months ● Using F5 to distribute traffic at the DMZ zone Solving the OSS Istio pain with TSB: ● Managing multi cluster the DMZ zone ● Simpler and better VM onboarding expereince ● Better zero trust architecture DMZ F5 -> Two Tier Gateway • Istio Fundamentals (Free), En/中文 • Envoy Fundamentals (Free), En/中 文 • Tetrate

A PROXY Protocol plain-text header has the format: PROXY TCP4 192.0.2.0 192.0.2.255 42300 443\r\n  Proxy Protocol v2 #IstioCon Proxy Protocol client Server Establish TCP connection Proxy Protocol 0xffffffff -- ctmask 0xffffffff # packet sent back to envoy will be marked 1337 ip -f inet rule add fwmark 1337 lookup 133 ip -f inet route add local default dev lo table 133 ③ echo 1 > /proc/sys/net/ipv4/

POD POD POD POD S E R V I C E (Load balancer) www.my-application.com External Traffic 75% 25% Deployment Canary Releases Using Kubernetes Deployment POD POD POD S E R V I C E (Load balancer) External Traffic POD 50% 50% Deployment Canary Releases Using Kubernetes Deployment POD S E R V I C E (Load balancer) www.my-application.com External Traffic POD POD 0% 100% Deployment Deployment Across application Layers Deployment POD POD S E R V I C E (Load balancer) www.my-application.com External Traffic 75% 25% POD POD POD POD S E R V I C E (ClusterIP) 75% 25% POD POD Cross-version

locations across globe peering with the Internet closer to the customer ○ PoPs are mini AZs Region R1 AZ 1 AZ 2 AZ n Data Center DC1 Region Rn #IstioCon Application Deployment: Cloud Layout ● Multiple scenario Region R1 AZ 1 AZ 2 AZ n Data Center DC1 K8s Cluster K8s Cluster K8s Cluster K8s Cluster K8s Cluster K8s Cluster Region Rn #IstioCon Application Specs Region R1 Application specs ● Standardization provides flexibility to switch backend implementations to software Region R1 AZ 1 AZ 2 AZ n Data Center DC1 K8s Cluster K8s Cluster K8s Cluster K8s Cluster AZ

"kubernetes://istio-pilot-8696f764dd-fqxtg.istio-system", • "3a7a649f-4eeb-4d70-972c-ad2d43a680af", • "172.00.00.000","Thu, 05 Jul 2018 08:12:19 GMT","780", • "bc1f172f-b8e3-4ec0-a070-f2f6de38a24f","718"]转换成属性词汇异步Flush到Adapter

[2021-03-31T11:16:55.538Z] "GET /aaabbbcccddd HTTP/1.1" 503 UO"-" "-" 0 81 5 - "-" "-" "3c2a392c-56fc-9d8c-9895-f657a4444679" "test-503-svc:8080" "-" - - 10.106.246.126:8080 10.244.92.179:48788 - default 原因分析 1. 128 -t 60s --keepalive=false http://backend-welink:8123 #http1 • nighthawk #http2 • perf record -F 2000 -g -p $pid; perf script -i perf.data > out.perf; stackcollapse-perf.pl out.perf > out.folded; flamegraph