L3toL7-MitchConnors-BernardVanDeWalle.pdf

1、Bernard Van De Walle,SplunkMitch Connors,AviatrixNetwork Security at ScaleMeet Your SpeakersBernard Van De WallePrincipal software engineer,SplunkK8s,Istio,Envoy operations at scalePreviously at CruiseMitch ConnorsPrincipal software engineer,AviatrixIstio Member since 2018Istio TOCSplunk Cloud:Cloud

2、 Native splunkScale:35 K8s clustersDistributed across all regionsAWS and GCPCloud agnostic,K8s,Istio,EnvoyAGENDAL3/L4:Cloud ProviderVPCNetwork Load BalancerL3/L4:KubernetesServicesNetwork PoliciesL7:Istio/EnvoyAuthN/AuthZCloud ProviderL3/L4Standard VPCIsolated standard VPC3 set of subnets:Private fo

3、r Kubernetes workloadsPublic for Internet connectivityInternal for Splunk connectivityNetwork ACLsStatelessApplied by subnetBasic L3/L4 capabilitiesProvides a catch-all last resort set of rulesExample:Internal subnet SRC 10.x/8Kubernetes nodesCluster nodes deployed on private IP spaceMultiple node-g

4、roups:Ingress(Gateways)GenericWorkload-specificSecurity GroupsStatefulApplied per instanceAllow for fine-grained traffic across specific instancesExample:Ingress node-group-Generic node-groupIngress connectivityConnectivity through NLBsPublic NLBsInternal NLBsConnectivity through Ingress Gateways(En

5、voy/Istio)Internal connectivity(transit gateway)Internal connectivity through AWS transit gatewayInternal SRC IP advertised onlyConnected to Splunk firewallCloud connectivity(Aviatrix)Cloud services connectivity through AviatrixFlat networkSupports overlapping IPsAviatrix Network DomainsBy Default A

6、ll connected domains are routable in flat network across clouds,regions,on-premNetwork Domains limit routesProd can talk to Shared,Dev can talk to Shared,Dev cannot talk to ProdKubernetesL3/L4Kubernetes deploymentSelf-Service platformExternal connectivity ONLY through NLBsPod to pod connectivity and

7、 Network policies through CalicoValidatingWebhookSplunk validating webhookDenies service type load-balancerPlenty of open implementationsOPAK-Rail(https:/ on K8SK8S-centric,L3/L4,statefulImplemented by your CNI plugin(Cilium,Calico,.)IstioL7Istio Service MeshApplication Layer NetworkingAll POST requ

8、ests from svc A route to this subset of svc BWhat is the success latency from svc A to svc B?svc A may send GET requests to svc B only at path/foo/*/barHow do we do it?Traffic RoutingObservabilitySecurityIstio Service MeshIn-transit encryptionRun the mesh in permissive modeMonitor the passthrough cl

9、uster and alert teams not using mTLSAlternative to strict modeGateway provisioningIngress only through NLB/gatewaysFor all types of traffic(HTTP/TCP)NLB/Gateways perIngress source(public/internal)Workload types/Blast radiusGateway provisioned in istio-gateway namespaceIngress setupGateway CRDIstio-g

10、ateway namespaceVirtualService CRDWorkload namespaceCertificate through LetsEncryptGated through ValidationWebhookService abstraction layer“Golden path”abstraction layer for 80%of the use casesA single abstraction layer for:VirtualServices,DestinationRules,Gateways and ServiceEntry CRDCertificate ma

11、nagementDNS managementOpenAPI spec per serviceAbstraction Layer controller scrapes those openAPI specsLayer7 AuthenticationGateways authenticate requests through envoy ExtAuthZextAuthZ-proxy allows plugins by adding them inlineBogus requests are blocked on the gatewayMore info:External Authorization

12、 envoy 1.26.0-dev-7cc893 documentationIP/HTTP AllowList with IstioAllowLists on L4-L7Mix and match IP and HTTP conceptsJWT Auth with IstioJWT validation in IstioLife of an ingress requestVPC/K8s apply policies per connectionIstio/Envoy apply policies per requestPain PointsRunning One Proxy Per Insta

13、nceEvery instance of every application gets a sidecar instancePros:Envoy can control all trafficCons:So.Many.Envoys.Vertical Scaling becomes extremely expensive.Managing the MagicPods Deployment SpecInjection modifies Pods,not DeploymentsPods Deployment+InjectionInjection only occurs at Pod creation

14、 timeWhich version of Envoy?_()_/Sidecars can be automatically added to applicable Kubernetes pods using a mutating webhook admission controller provided by Istio.When you set the istio-injection=enabled label on a namespace and the injection webhook is enabled,any new pods that are created in that

15、namespace will automatically have a sidecar added to them.-istio.ioAmbient Reduces User PainOne L4 Proxy per NodeOne scalable L7 Proxy per Service Account+GatewayAll proxies are managed through Deployments/DaemonsetsPods=Deployment SpecFor more info:istio.io/latest/blog/2022/introducing-ambient-mesh

16、/ConclusionIdentityPolicyObservabilityVPC Network ACLsIP/Ports/VMNetwork ACLsSecurityGroupsVPC Flow LogsAviatrixNetwork DomainsNetwork DomainsCopilot Flow LogsK8SIP/Ports/PodsNetworkPolicyNode TelemetryIstioServiceAccountRequest HeadersAuthN/AuthZAuthorizationPoliciesRequestPoliciesIstio TelemetryDe

17、fense at Every LayerSelf-service platforms are hardSafeguards to avoid users shooting themselves in the footProvide a Golden Path to avoid configuration errorsDefense in depth:Add redundant security at all layersObservability is keyHelp debugDetect misconfigurationPlease scan the QR Code aboveto leave feedback on this sessionThank You!