Good observability in a microservice architecture is not easy. Istio can help to remove the complexity from developers and leave the work to the operator. Learn how to gain a deeper understanding of using Istio for monitoring tasks, while using Istio security features to secure your microservices and spot security anomalies. For the recorded webinar: https://bit.ly/2KNaGmc

1. Using Istio to
Secure & Monitor
Your Services
Webinar
April 16, 2019

2. Agenda
￫ Why a service mesh?
￫ Istio security stack
￫ Extending Istio security
￫ Istio monitoring concepts
￫ Istio monitoring stack
￫ Extending monitoring

3. Why Service Mesh? And Why Now?
￫ Microservices and highly distributed architecture - HARD
￫ Intelligent routing (canary deployments ) - HARD
￫ Observability ← → Ops & Monitoring - HARD
￫ Securing microservices - VERY HARD
Service mesh defined:
Uniform Application Runtime which introduce Observability and Control

4. Connect
￫ Layer 7 path-based routing
￫ Traffic shaping
￫ Load balancing - A/B testing, canarying
Manage
￫ Telemetry
￫ Fleet-wide Visibility - Zipkin, Prometheus & Grafana
Secure
￫ Identity based service access control
￫ Service authorization - API level access control
￫ Service-Service encryption with TLS (mTLS)
What’s in the mesh?
Connect, manage and secure microservices

5. https://cloud.google.com/security/encryption-in-transit/application-layer-transport-security/
ATLS - “Istio”

6. Controlling Envoy Dataplane
￫ Logging
￫ Quota
￫ Authz (more later)
￫ Telemetry (more later)

7. Istio 1.1 at glance
￫ Namespace Isolation (Sidecar Resource - next slide)
￫ Multi-Cluster
￫ Helm based Installation
￫ Locality based Load Balancing
￫ Identity Provision through SDS (Secret Discovery Service)
￫ Vault CA Integration
￫ Egress Policy (On by default)
￫ Policy Checks (Off by default)
￫ Improved perf, scale & stability

8. Sidecar proxy - inbound and outbound config
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
name: no-ip-tables
namespace: prod-us1
spec:
workloadSelector:
labels:
app: productpage
ingress:
- port:
number: 9080 # binds to 0.0.0.0:9080
protocol: HTTP
name: somename
defaultEndpoint: 127.0.0.1:8080
captureMode: NONE # not needed if metadata
is set for entire proxy
egress:
- port:
number: 3306
protocol: MYSQL
name: egressmysql
captureMode: NONE # not needed if metadata
is set for entire proxy
bind: 127.0.0.1
hosts:
- "*/mysql.foo.com"
Scope
Traffic Routing
Mode
Istio Sidecar Resource
￫ Namespace Isolation
￫ Single default config per namespace
￫ Workload Selector overrides
￫ Can Restrict Egress Traffic

9. Example: Grant authenticated users with read access to version v1,v2 of products service
apiVersion:
"rbac.istio.io/v1alpha1"
kind: RbacConfig
metadata:
name: default
spec:
mode: 'ON_WITH_INCLUSION'
inclusion:
namespaces: ["default"]
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRole
metadata:
name: products-viewer-version
namespace: default
spec:
rules:
- services: ["products.default.svc.cluster.local"]
methods: ["GET", "HEAD"]
constraints:
- key: request.headers[version]
values: ["v1", "v2"]
apiVersion: "rbac.istio.io/v1alpha1"
kind: ServiceRoleBinding
metadata:
name: binding-products-all-authenticated-users
namespace: default
spec:
subjects:
- properties:
source.principal: "*"
roleRef:
kind: ServiceRole
name: "products-viewer-version"
read access
authenticated
users
condition
Istio Service Authorization (RBAC)

10. Istio 1.2 - Staying Ahead of the (Authz) Curve
￫ Authorization APIs Rev 2.0
￫ Authorization Istio config model -
base label selector.
￫ Flexible policy semantics -
exclusion and expression condition.
￫ Support DENY semantics.
￫ Introducing mesh global policies.
￫ Allow policies to be applied to the edge (ingress/egress).
￫ Introduce inline permissions for better user experience.
Authorization APIs Evolve

11. Use Case: PCI DSS Compliance
￫ Cluster X: PCI Cardholder services &
workloads
￫ Cluster A: Customer facing service &
workloads
￫ In-Cluster special segmentation
￫ Cross Clusters & VPCs policies
￫ Istio Network Policies
￫ DevSecOps overhead
￫ Compute Resource overhead
Commerce Application On Istio
Istio
Control Plane

12. Extend Istio Security w/ Off-Mesh Security
￫ Workload Escape
￫ Sidecar Vulnerability Blast Radius
￫ System/Control Plane Workloads Defense
￫ DNS Tunneling as Kubernetes service discovery
￫ Apply machine learning based profiling, detection & mitigation of post intrusion
events such as data exfiltration, lateral movement, and command & control
communications.

13. Security & 4 Golden Signals of Monitoring
￫ Latency - time it takes to service a request
￫ Traffic - how much demand is being placed on your system (RPS)
￫ Errors - The request fail rates (HTTP 500, HTTP 443, ...)
￫ Saturation - How “full” is your service.
https://landing.google.com/sre/sre-book/chapters/monitoring-distributed-systems/

14. Istio Monitoring Concepts
￫ Mixer / Proxies

15. Istio Monitoring Concepts
￫ Mixer / Proxies
￫ Backend

16. ￫ Mixer / Proxies
￫ Backend
￫ Telemetry attributes
Istio Monitoring Concepts

17. ￫ Mixer / Proxies
￫ Backend
￫ Telemetry attributes
￫ Adapter
Istio Monitoring Concepts

18. ￫ Mixer / Proxies
￫ Backend
￫ Telemetry attributes
￫ Adapter
￫ Instance
Istio Monitoring Concepts

19. ￫ Mixer / Proxies
￫ Backend
￫ Telemetry attributes
￫ Adapter
￫ Instance
￫ Handler
Istio Monitoring Concepts

20. ￫ Mixer / Proxies
￫ Backend
￫ Telemetry attributes
￫ Adapter
￫ Instance
￫ Handler
￫ Rule
Istio Monitoring Concepts

21. Istio Monitoring Stack
￫ Prometheus

22. Istio Monitoring Stack
￫ Prometheus
￫ Grafana

23. Istio Monitoring Stack
￫ Prometheus
￫ Grafana
￫ Kiali

24. Data Plane Monitoring
Proxy sidecar
Application
￫ Latency penalty (BPF integration / CNI plugin)
￫ Performance degradation (SDS)
￫ Resources consumption ( > version 1.1)
￫ RED method (blackbox monitoring)
￫ Rate
￫ Errors
￫ Duration

25. Control Plane Monitoring
￫ Pilot
￫ Ingress / Egress gateway(s)
￫ Policy mixer
￫ Upgrade process

26. Extending Monitoring
￫ Mixer adapters

27. Extending Monitoring
￫ Mixer adapters
￫ Expose new metrics

28. Extending Monitoring
￫ Mixer adapter
￫ Expose new metrics
￫ Instrument your code (whitebox monitoring)

29. Extending Monitoring
￫ Mixer adapter
￫ Expose new metrics
￫ Instrument your code
￫ HTTP API Spec

30. Your Top 3 Takeaways
Security
➔ Understand mesh network policy
➔ Track mesh components
➔ Extend observability
Monitoring
➔ Understand the concepts
➔ Track mesh components
➔ Extend observability

31. Q & A

32. Learn More
Webinar will be available at:
https://giantswarm.io/
Additional reading:
https://blog.giantswarm.io/
Visit us at KubeCon Barcelona:
Booth #SE-7
Webinar will be available at:
https://www.alcide.io/
Additional reading:
https://blog.alcide.io/
Visit us at KubeCon Barcelona:
Booth #SE-47

33. Thank You!
gadinaor
gadinaor
pipo02mix
fernando-ripoll-lafuente
@pipo02mix