L3toL7-MitchConnors-BernardVanDeWalle.pdf

编号:140609 PDF 37页 3.68MB 下载积分:VIP专享
下载报告请您先登录!

L3toL7-MitchConnors-BernardVanDeWalle.pdf

1、Bernard Van De Walle,SplunkMitch Connors,AviatrixNetwork Security at ScaleMeet Your SpeakersBernard Van De WallePrincipal software engineer,SplunkK8s,Istio,Envoy operations at scalePreviously at CruiseMitch ConnorsPrincipal software engineer,AviatrixIstio Member since 2018Istio TOCSplunk Cloud:Cloud

2、 Native splunkScale:35 K8s clustersDistributed across all regionsAWS and GCPCloud agnostic,K8s,Istio,EnvoyAGENDAL3/L4:Cloud ProviderVPCNetwork Load BalancerL3/L4:KubernetesServicesNetwork PoliciesL7:Istio/EnvoyAuthN/AuthZCloud ProviderL3/L4Standard VPCIsolated standard VPC3 set of subnets:Private fo

3、r Kubernetes workloadsPublic for Internet connectivityInternal for Splunk connectivityNetwork ACLsStatelessApplied by subnetBasic L3/L4 capabilitiesProvides a catch-all last resort set of rulesExample:Internal subnet SRC 10.x/8Kubernetes nodesCluster nodes deployed on private IP spaceMultiple node-g

4、roups:Ingress(Gateways)GenericWorkload-specificSecurity GroupsStatefulApplied per instanceAllow for fine-grained traffic across specific instancesExample:Ingress node-group-Generic node-groupIngress connectivityConnectivity through NLBsPublic NLBsInternal NLBsConnectivity through Ingress Gateways(En

5、voy/Istio)Internal connectivity(transit gateway)Internal connectivity through AWS transit gatewayInternal SRC IP advertised onlyConnected to Splunk firewallCloud connectivity(Aviatrix)Cloud services connectivity through AviatrixFlat networkSupports overlapping IPsAviatrix Network DomainsBy Default A

6、ll connected domains are routable in flat network across clouds,regions,on-premNetwork Domains limit routesProd can talk to Shared,Dev can talk to Shared,Dev cannot talk to ProdKubernetesL3/L4Kubernetes deploymentSelf-Service platformExternal connectivity ONLY through NLBsPod to pod connectivity and

7、 Network policies through CalicoValidatingWebhookSplunk validating webhookDenies service type load-balancerPlenty of open implementationsOPAK-Rail(https:/ on K8SK8S-centric,L3/L4,statefulImplemented by your CNI plugin(Cilium,Calico,.)IstioL7Istio Service MeshApplication Layer NetworkingAll POST requ

8、ests from svc A route to this subset of svc BWhat is the success latency from svc A to svc B?svc A may send GET requests to svc B only at path/foo/*/barHow do we do it?Traffic RoutingObservabilitySecurityIstio Service MeshIn-transit encryptionRun the mesh in permissive modeMonitor the passthrough cl

9、uster and alert teams not using mTLSAlternative to strict modeGateway provisioningIngress only through NLB/gatewaysFor all types of traffic(HTTP/TCP)NLB/Gateways perIngress source(public/internal)Workload types/Blast radiusGateway provisioned in istio-gateway namespaceIngress setupGateway CRDIstio-g

10、ateway namespaceVirtualService CRDWorkload namespaceCertificate through LetsEncryptGated through ValidationWebhookService abstraction layer“Golden path”abstraction layer for 80%of the use casesA single abstraction layer for:VirtualServices,DestinationRules,Gateways and ServiceEntry CRDCertificate ma

11、nagementDNS managementOpenAPI spec per serviceAbstraction Layer controller scrapes those openAPI specsLayer7 AuthenticationGateways authenticate requests through envoy ExtAuthZextAuthZ-proxy allows plugins by adding them inlineBogus requests are blocked on the gatewayMore info:External Authorization

12、 envoy 1.26.0-dev-7cc893 documentationIP/HTTP AllowList with IstioAllowLists on L4-L7Mix and match IP and HTTP conceptsJWT Auth with IstioJWT validation in IstioLife of an ingress requestVPC/K8s apply policies per connectionIstio/Envoy apply policies per requestPain PointsRunning One Proxy Per Insta

13、nceEvery instance of every application gets a sidecar instancePros:Envoy can control all trafficCons:So.Many.Envoys.Vertical Scaling becomes extremely expensive.Managing the MagicPods Deployment SpecInjection modifies Pods,not DeploymentsPods Deployment+InjectionInjection only occurs at Pod creation

14、 timeWhich version of Envoy?_()_/Sidecars can be automatically added to applicable Kubernetes pods using a mutating webhook admission controller provided by Istio.When you set the istio-injection=enabled label on a namespace and the injection webhook is enabled,any new pods that are created in that

15、namespace will automatically have a sidecar added to them.-istio.ioAmbient Reduces User PainOne L4 Proxy per NodeOne scalable L7 Proxy per Service Account+GatewayAll proxies are managed through Deployments/DaemonsetsPods=Deployment SpecFor more info:istio.io/latest/blog/2022/introducing-ambient-mesh

16、/ConclusionIdentityPolicyObservabilityVPC Network ACLsIP/Ports/VMNetwork ACLsSecurityGroupsVPC Flow LogsAviatrixNetwork DomainsNetwork DomainsCopilot Flow LogsK8SIP/Ports/PodsNetworkPolicyNode TelemetryIstioServiceAccountRequest HeadersAuthN/AuthZAuthorizationPoliciesRequestPoliciesIstio TelemetryDe

17、fense at Every LayerSelf-service platforms are hardSafeguards to avoid users shooting themselves in the footProvide a Golden Path to avoid configuration errorsDefense in depth:Add redundant security at all layersObservability is keyHelp debugDetect misconfigurationPlease scan the QR Code aboveto leave feedback on this sessionThank You!

友情提示

1、下载报告失败解决办法
2、PDF文件下载后,可能会被浏览器默认打开,此种情况可以点击浏览器菜单,保存网页到桌面,就可以正常下载了。
3、本站不支持迅雷下载,请使用电脑自带的IE浏览器,或者360浏览器、谷歌浏览器下载即可。
4、本站报告下载后的文档和图纸-无水印,预览文档经过压缩,下载后原文更清晰。

本文(L3toL7-MitchConnors-BernardVanDeWalle.pdf)为本站 (2200) 主动上传,三个皮匠报告文库仅提供信息存储空间,仅对用户上传内容的表现方式做保护处理,对上载内容本身不做任何修改或编辑。 若此文所含内容侵犯了您的版权或隐私,请立即通知三个皮匠报告文库(点击联系客服),我们立即给予删除!

温馨提示:如果因为网速或其他原因下载失败请重新下载,重复下载不扣分。
客服
商务合作
小程序
服务号
会员动态
会员动态 会员动态:

飞天 升级为标准VIP 133**05... 升级为标准VIP

微**... 升级为高级VIP 安静 升级为标准VIP

wei**n_... 升级为标准VIP 微**... 升级为标准VIP

鬼魅 升级为至尊VIP wei**n_... 升级为至尊VIP

139**10... 升级为高级VIP r**a 升级为标准VIP

136**88... 升级为高级VIP wei**n_... 升级为至尊VIP

wei**n_... 升级为至尊VIP 镆铘 升级为至尊VIP

是**... 升级为高级VIP Inf**it... 升级为标准VIP

158**09... 升级为标准VIP wei**n_... 升级为高级VIP

177**04... 升级为标准VIP 199**00... 升级为至尊VIP

136**67... 升级为至尊VIP 升级为标准VIP

186**47... 升级为标准VIP wei**n_... 升级为至尊VIP

石** 升级为高级VIP wei**n_... 升级为标准VIP

159**39... 升级为高级VIP wei**n_... 升级为标准VIP

136**14... 升级为高级VIP 159**20... 升级为标准VIP

wei**n_... 升级为标准VIP wei**n_... 升级为高级VIP

136**87... 升级为高级VIP Pa**CJ 升级为至尊VIP

wei**n_... 升级为至尊VIP 151**30... 升级为高级VIP

wei**n_... 升级为高级VIP wei**n_... 升级为至尊VIP

193**71... 升级为高级VIP 135**14... 升级为至尊VIP

微**... 升级为高级VIP wei**n_... 升级为高级VIP

177**34... 升级为至尊VIP 139**75... 升级为标准VIP

wei**n_... 升级为标准VIP 159**45... 升级为至尊VIP

wei**n_... 升级为至尊VIP 185**34... 升级为标准VIP

139**29... 升级为至尊VIP wei**n_... 升级为至尊VIP

狂**... 升级为至尊VIP 185**96... 升级为至尊VIP

138**22... 升级为至尊VIP wei**n_... 升级为高级VIP

dav**lu... 升级为至尊VIP wei**n_... 升级为高级VIP

186**92... 升级为高级VIP 183**77... 升级为至尊VIP

185**95... 升级为标准VIP wei**n_... 升级为高级VIP

wei**n_... 升级为至尊VIP wei**n_... 升级为高级VIP

wei**n_... 升级为高级VIP wei**n_... 升级为标准VIP

wei**n_... 升级为至尊VIP 153**57... 升级为高级VIP

emp**or 升级为至尊VIP xi**ey 升级为至尊VIP

wei**n_... 升级为至尊VIP 188**16... 升级为至尊VIP

wei**n_... 升级为至尊VIP wei**n_... 升级为高级VIP

151**01... 升级为高级VIP wei**n_... 升级为标准VIP

ath**e@... 升级为高级VIP 186**90... 升级为至尊VIP

wei**n_... 升级为高级VIP wei**n_... 升级为标准VIP

wei**n_... 升级为高级VIP 131**19... 升级为至尊VIP

138**03... 升级为标准VIP 137**20... 升级为标准VIP

wei**n_... 升级为高级VIP 微**... 升级为高级VIP

wei**n_... 升级为标准VIP 136**07... 升级为至尊VIP

随**... 升级为至尊VIP wei**n_... 升级为至尊VIP

wei**n_... 升级为标准VIP 189**76... 升级为至尊VIP

Ma 升级为至尊VIP 157**81... 升级为标准VIP

153**87... 升级为高级VIP wei**n_... 升级为标准VIP

wei**n_... 升级为标准VIP wei**n_... 升级为高级VIP

微**... 升级为至尊VIP wei**n_... 升级为标准VIP

wei**n_... 升级为至尊VIP Al**n在... 升级为高级VIP