Contents
What security features does Istio offer?
The Istio security features provide strong identity, powerful policy, transparent TLS encryption, and authentication, authorization and audit (AAA) tools to protect your services and data.
How does Istio intercept traffic?
The Init container is used to set iptables (the default traffic interception method in Istio, and can also use BPF, IPVS, etc.) to Intercept traffic entering the pod to Envoy sidecar Proxy.
What is SDS in Istio?
The Control Ingress Traffic task describes how to configure an ingress gateway to expose an HTTP service to external traffic. This task shows how to expose a secure HTTPS service using either simple or mutual TLS.
Does Istio authentication include key management?
The figure below shows the Istio Auth architecture, which includes three components: identity, key management, and communication security. It describes how Istio Auth is used to secure service-to-service communication between service A, running as service account “foo”, and service B, running as service account “bar”.
Does Istio use Spiffe?
Istio uses X. 509 certificates to carry the identities in SPIFFE format. The PKI also automates the key & certificate rotation at scale. Istio supports services running on both Kubernetes pods and on-premises machines.
Does Istio use TLS?
Istio automatically configures workload sidecars to use mutual TLS when calling other workloads. By default, Istio configures the destination workloads using PERMISSIVE mode. When PERMISSIVE mode is enabled, a service can accept both plain text and mutual TLS traffic.
Does Istio need ingress?
A Kubernetes Ingress Resources exposes HTTP and HTTPS routes from outside the cluster to services within the cluster. The kubernetes.io/ingress.class annotation is required to tell the Istio gateway controller that it should handle this Ingress , otherwise it will be ignored.
Does Kubernetes use Istio?
Istio is currently the most popular service mesh implementation, relying on Kubernetes but also scalable to virtual machine loads. Istio’s core consists of a control plane and a data plane, with Envoy as the default data-plane agent.
What is SDS Kubernetes?
Fortunately, SDS allows you to abstract all capacity provided by this hardware and merge it into a single storage pool that is infinitely flexible and scalable. In general, SDS offers the following benefits for the containerized applications: You can choose any storage hardware to support your containerized workloads.
What is secret discovery service?
The secret discovery service (SDS) simplifies certificate management and was originally created by the Envoy project to provide a flexible API to deliver secrets/certificates to the Envoy proxy. Step SDS server implements the server-side API of SDS which pushes certificates to the client.
What is Destination rule in Istio?
DestinationRule defines policies that apply to traffic intended for a service after routing has occurred. These rules specify configuration for load balancing, connection pool size from the sidecar, and outlier detection settings to detect and evict unhealthy hosts from the load balancing pool.
What is Spiffe?
SPIFFE, the Secure Production Identity Framework for Everyone, is a set of open-source standards for securely identifying software systems in dynamic and heterogeneous environments.
What are the security features of Istio security?
The Istio security features provide strong identity, powerful policy, transparent TLS encryption, and authentication, authorization and audit (AAA) tools to protect your services and data. The goals of Istio security are:
How to run Istio control plane with limited privileges?
We often use Pod Security Policies (PSPs) in Kubernetes to ensure that pods run with only restricted privileges. In this post, we’ll discuss how to run Istio’s control plane components with as few privileges as possible, using restricted PSPs and the open source Banzai Cloud Istio operator.
What kind of initcontainer does Istio use?
By default, Istio uses an injected initContainer called istio-init to create iptables rules before the other containers in the pod can start.
Where are the authentication policies stored in Istio?
In all cases, Istio stores the authentication policies in the Istio config store via a custom Kubernetes API. Istiod keeps them up-to-date for each proxy, along with the keys where appropriate.