○ kubectl exec -c istio-proxy curl localhost:15000/config_dump #IstioCon Istio identity – check configuration result ● Result: cert generated automatically with Istio identity 1) Apply peer-authentication matchLabels: app: reviews mtls: mode: STRICT 1) Apply destination rule to enable client side mTLS mTLS in Istio - Destination rule Using ingress port and ingress host to send request: can access reviews-v1 ISTIO_MUTUAL mode on client side Access productpage 1) Apply destination rule enable client side mTLS mTLS in Istio - Destination rule http http http http mTLS mTLS #IstioCon mTLS in Istio - DestinationRule

Limited Syscall H O S T K E R N E L Comparison Solution Typical Software Bullet Point Rule-based Sandbox RunC Needs to work with SELinux, AppArmor, Seccomp, cgroup VM-based Sandbox Kata-container

ctet- stream" \ --data-binary "@target/wasm32- unknown-unknown/release/examples/ $3.wasm" Mock rule based on path matching regex extern crate wapc_guest as guest; #[macro_use] extern crate wasm_mock_util;

Size limitation of BPF program is one million after Linux 5.2 Lessons from eBPF • Too strict check in eBPF verifier • Example: s64 bpf_csum_diff(__be32 * from, u32 from_size, __be32 * to, u32 to_size);

2018 Percona. 36 Anyone dumping a lot of data ? © 2018 Percona. 37 Want Processed Logs ? Check out Percona Monitoring and Management © 2018 Percona. 38 Need Help ? Percona - MySQL, MariaDB

Global Cleanup Implementation • Must collect all retired objects (including in private caches) • Must check all hazard pointers against collected objects • Must complete reclamation of all unprotected objects

std::optional  New members for std::optional to chain operations on an optional without having to check for them being empty  transform(F)  returns optional containing result of invoking F on *this