mirror of https://github.com/istio/istio.io.git
91 lines
30 KiB
HTML
91 lines
30 KiB
HTML
<!doctype html><html lang=en itemscope itemtype=https://schema.org/WebPage><head><meta charset=utf-8><meta http-equiv=X-UA-Compatible content="IE=edge"><meta name=viewport content="width=device-width,initial-scale=1,shrink-to-fit=no"><meta name=theme-color content="#466BB0"><meta name=title content="Secure Control of Egress Traffic in Istio, part 3"><meta name=description content="Comparison of alternative solutions to control egress traffic including performance considerations."><meta name=author content="Vadim Eisenberg (IBM)"><meta name=keywords content="microservices,services,mesh,traffic-management,egress,security,gateway,tls"><meta property="og:title" content="Secure Control of Egress Traffic in Istio, part 3"><meta property="og:type" content="website"><meta property="og:description" content="Comparison of alternative solutions to control egress traffic including performance considerations."><meta property="og:url" content="/v1.21/blog/2019/egress-traffic-control-in-istio-part-3/"><meta property="og:image" content="https://raw.githubusercontent.com/istio/istio.io/master/static/img/istio-social.png"><meta property="og:image:alt" content="The Istio sailboat logo"><meta property="og:image:width" content="4096"><meta property="og:image:height" content="2048"><meta property="og:site_name" content="Istio"><meta name=twitter:card content="summary_large_image"><meta name=twitter:site content="@IstioMesh"><title>Istioldie 1.21 / Secure Control of Egress Traffic in Istio, part 3</title>
|
|
<script async src="https://www.googletagmanager.com/gtag/js?id=UA-98480406-2"></script><script>window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","UA-98480406-2")</script><link rel=alternate type=application/rss+xml title="Istio Blog" href=/v1.21/blog/feed.xml><link rel=alternate type=application/rss+xml title="Istio News" href=/v1.21/news/feed.xml><link rel=alternate type=application/rss+xml title="Istio Blog and News" href=/v1.21/feed.xml><link rel="shortcut icon" href=/v1.21/favicons/favicon.ico><link rel=apple-touch-icon href=/v1.21/favicons/apple-touch-icon-180x180.png sizes=180x180><link rel=icon type=image/png href=/v1.21/favicons/favicon-16x16.png sizes=16x16><link rel=icon type=image/png href=/v1.21/favicons/favicon-32x32.png sizes=32x32><link rel=icon type=image/png href=/v1.21/favicons/android-36x36.png sizes=36x36><link rel=icon type=image/png href=/v1.21/favicons/android-48x48.png sizes=48x48><link rel=icon type=image/png href=/v1.21/favicons/android-72x72.png sizes=72x72><link rel=icon type=image/png href=/v1.21/favicons/android-96x96.png sizes=96xW96><link rel=icon type=image/png href=/v1.21/favicons/android-144x144.png sizes=144x144><link rel=icon type=image/png href=/v1.21/favicons/android-192x192.png sizes=192x192><link rel=icon type=image/svg+xml href=/v1.21/favicons/favicon.svg><link rel=icon type=image/png href=/v1.21/favicons/favicon.png><link rel=mask-icon href=/v1.21/favicons/safari-pinned-tab.svg color=#466BB0><link rel=manifest href=/v1.21/manifest.json><meta name=apple-mobile-web-app-title content="Istio"><meta name=application-name content="Istio"><meta name=msapplication-config content="/browserconfig.xml"><meta name=msapplication-TileColor content="#466BB0"><meta name=theme-color content="#466BB0"><link rel=stylesheet href=/v1.21/css/all.css><link rel=preconnect href=https://fonts.googleapis.com><link rel=preconnect href=https://fonts.gstatic.com crossorigin><link rel=stylesheet href="https://fonts.googleapis.com/css2?family=Barlow:ital,wght@0,400;0,500;0,600;0,700;1,400;1,600&display=swap"><script src=/v1.21/js/themes_init.min.js></script></head><body class="language-unknown archive-site"><script>const branchName="release-1.21",docTitle="Secure Control of Egress Traffic in Istio, part 3",iconFile="/v1.21//img/icons.svg",buttonCopy="Copy to clipboard",buttonPrint="Print",buttonDownload="Download"</script><script src="https://www.google.com/cse/brand?form=search-form" defer></script><script src=/v1.21/js/all.min.js data-manual defer></script><header class=main-navigation><nav class="main-navigation-wrapper container-l"><div class=main-navigation-header><a id=brand href=/v1.21/ aria-label=logotype><span class=logo><svg xmlns="http://www.w3.org/2000/svg" width="128" height="60" viewBox="0 0 128 60"><path d="M58.434 48.823A.441.441.0 0158.3 48.497V22.583a.444.444.0 01.134-.326.446.446.0 01.327-.134h3.527a.447.447.0 01.325.134.447.447.0 01.134.326v25.914a.443.443.0 01-.134.326.444.444.0 01-.325.134h-3.527a.444.444.0 01-.327-.134z"/><path d="m70.969 48.477a6.556 6.556.0 01-2.818-1.955 4.338 4.338.0 01-1-2.78v-.345a.443.443.0 01.134-.326.444.444.0 01.326-.135h3.374a.444.444.0 01.326.135.445.445.0 01.134.326v.077a2.014 2.014.0 001.054 1.667 4.672 4.672.0 002.664.709 4.446 4.446.0 002.492-.633 1.862 1.862.0 00.958-1.591 1.426 1.426.0 00-.786-1.322 12.7 12.7.0 00-2.549-.939l-1.457-.46a21.526 21.526.0 01-3.3-1.227 6.57 6.57.0 01-2.262-1.783 4.435 4.435.0 01-.92-2.894 5.081 5.081.0 012.109-4.275 8.993 8.993.0 015.558-1.591 10.445 10.445.0 014.1.748 6.3 6.3.0 012.722 2.07 5 5 0 01.958 3.009.441.441.0 01-.134.326.441.441.0 01-.325.134h-3.258a.441.441.0 01-.326-.134.443.443.0 01-.134-.326 1.974 1.974.0 00-.978-1.667 4.647 4.647.0 00-2.665-.671 4.741 4.741.0 00-2.435.556 1.724 1.724.0 00-.938 1.553 1.512 1.512.0 00.9 1.4 15.875 15.875.0 003.01 1.055l.843.229a27.368 27.368.0 013.412 1.246 6.67 6.67.0 012.338 1.763 4.387 4.387.0 01.958 2.933 4.988 4.988.0 01-2.146 4.275 9.543 9.543.0 01-5.712 1.552 11.626 11.626.0 01-4.227-.709z"/><path d="m97.039 32.837a.443.443.0 01-.326.135h-3.911a.169.169.0 00-.191.192v9.239a2.951 2.951.0 00.632 2.108 2.7 2.7.0 002.013.652h1.15a.444.444.0 01.325.134.441.441.0 01.134.326v2.875a.471.471.0 01-.459.5l-1.994.039a8 8 0 01-4.524-1.035q-1.495-1.035-1.533-3.91V33.166A.17.17.0 0088.164 32.974H85.978A.441.441.0 0185.652 32.839.441.441.0 0185.518 32.513V29.83a.441.441.0 01.134-.326.444.444.0 01.326-.135h2.186a.169.169.0 00.191-.192v-4.485a.438.438.0 01.134-.326.44.44.0 01.325-.134h3.336a.443.443.0 01.325.134.442.442.0 01.135.326v4.485a.169.169.0 00.191.192h3.911a.446.446.0 01.326.135.446.446.0 01.134.326v2.683a.446.446.0 01-.133.324z"/><path d="m101.694 25.917a2.645 2.645.0 01-.767-1.955 2.65 2.65.0 01.767-1.955 2.65 2.65.0 011.955-.767 2.65 2.65.0 011.955.767 2.652 2.652.0 01.767 1.955 2.647 2.647.0 01-.767 1.955 2.646 2.646.0 01-1.955.767 2.645 2.645.0 01-1.955-.767zm-.211 22.906a.441.441.0 01-.134-.326V29.79a.444.444.0 01.134-.326.446.446.0 01.326-.134h3.527a.446.446.0 01.326.134.445.445.0 01.134.326v18.707a.443.443.0 01-.134.326.443.443.0 01-.326.134h-3.527a.443.443.0 01-.326-.134z"/><path d="m114.019 47.734a8.1 8.1.0 01-3.047-4.255 14.439 14.439.0 01-.652-4.37 14.3 14.3.0 01.614-4.371A7.869 7.869.0 01114 30.56a9.072 9.072.0 015.252-1.5 8.543 8.543.0 015.041 1.5 7.985 7.985.0 013.009 4.14 12.439 12.439.0 01.69 4.37 13.793 13.793.0 01-.651 4.37 8.255 8.255.0 01-3.028 4.275 8.475 8.475.0 01-5.1 1.553 8.754 8.754.0 01-5.194-1.534zm7.629-3.1a4.536 4.536.0 001.476-2.262 11.335 11.335.0 00.383-3.221 10.618 10.618.0 00-.383-3.22 4.169 4.169.0 00-1.457-2.243 4.066 4.066.0 00-2.531-.785 3.942 3.942.0 00-2.453.785 4.376 4.376.0 00-1.5 2.243 11.839 11.839.0 00-.383 3.22 11.84 11.84.0 00.383 3.221 4.222 4.222.0 001.476 2.262 4.075 4.075.0 002.549.8 3.8 3.8.0 002.44-.809z"/><path d="m15.105 32.057v15.565a.059.059.0 01-.049.059L.069 50.25A.06.06.0 01.005 50.167l14.987-33.47a.06.06.0 01.114.025z"/><path d="m17.631 23.087v24.6a.06.06.0 00.053.059l22.449 2.507a.06.06.0 00.061-.084L17.745.032a.06.06.0 00-.114.024z"/><path d="m39.961 52.548-24.833 7.45a.062.062.0 01-.043.0L.079 52.548a.059.059.0 01.026-.113h39.839a.06.06.0 01.017.113z"/></svg></span>
|
|
</a><button id=hamburger class=main-navigation-toggle aria-label="Open navigation">
|
|
<svg class="icon menu-hamburger"><use xlink:href="/v1.21/img/icons.svg#menu-hamburger"/></svg>
|
|
</button>
|
|
<button id=menu-close class=main-navigation-toggle aria-label="Close navigation"><svg class="icon menu-close"><use xlink:href="/v1.21/img/icons.svg#menu-close"/></svg></button></div><div id=header-links class=main-navigation-links-wrapper><ul class=main-navigation-links><li class=main-navigation-links-item><a class="main-navigation-links-link has-dropdown"><span>About</span><svg class="icon dropdown-arrow"><use xlink:href="/v1.21/img/icons.svg#dropdown-arrow"/></svg></a><ul class=main-navigation-links-dropdown><li class=main-navigation-links-dropdown-item><a href=/v1.21/about/service-mesh class=main-navigation-links-link>Service mesh</a></li><li class=main-navigation-links-dropdown-item><a href=/v1.21/about/solutions class=main-navigation-links-link>Solutions</a></li><li class=main-navigation-links-dropdown-item><a href=/v1.21/about/case-studies class=main-navigation-links-link>Case studies</a></li><li class=main-navigation-links-dropdown-item><a href=/v1.21/about/ecosystem class=main-navigation-links-link>Ecosystem</a></li><li class=main-navigation-links-dropdown-item><a href=/v1.21/about/deployment class=main-navigation-links-link>Deployment</a></li><li class=main-navigation-links-dropdown-item><a href=/v1.21/about/faq class=main-navigation-links-link>FAQ</a></li></ul></li><li class=main-navigation-links-item><a href=/v1.21/blog/ class=main-navigation-links-link><span>Blog</span></a></li><li class=main-navigation-links-item><a href=/v1.21/news/ class=main-navigation-links-link><span>News</span></a></li><li class=main-navigation-links-item><a href=/v1.21/get-involved/ class=main-navigation-links-link><span>Get involved</span></a></li><li class=main-navigation-links-item><a href=/v1.21/docs/ class=main-navigation-links-link><span>Documentation</span></a></li></ul><div class=main-navigation-footer><button id=search-show class=search-show title='Search this site' aria-label=Search><svg class="icon magnifier"><use xlink:href="/v1.21/img/icons.svg#magnifier"/></svg></button>
|
|
<a href=/v1.21/docs/setup/getting-started class="btn btn--primary" id=try-istio>Try Istio</a></div></div><form id=search-form class=search name=cse role=search><input type=hidden name=cx value=002184991200833970123:iwwf17ikgf4>
|
|
<input type=hidden name=ie value=utf-8>
|
|
<input type=hidden name=hl value=en>
|
|
<input type=hidden id=search-page-url value=/search>
|
|
<input id=search-textbox class="search-textbox form-control" name=q type=search aria-label='Search this site' placeholder=Search>
|
|
<button id=search-close title='Cancel search' type=reset aria-label='Cancel search'><svg class="icon menu-close"><use xlink:href="/v1.21/img/icons.svg#menu-close"/></svg></button></form></nav></header><div class=banner-container></div><article class=post itemscope itemtype=http://schema.org/BlogPosting><div class=header-content><h1>Secure Control of Egress Traffic in Istio, part 3</h1><p>Comparison of alternative solutions to control egress traffic including performance considerations.</p></div><p class=post-author>Jul 22, 2019 <span>| </span>By Vadim Eisenberg - IBM</p><div><aside class="callout warning"><div class=type><svg class="large-icon"><use xlink:href="/v1.21/img/icons.svg#callout-warning"/></svg></div><div class=content>This blog post was written assuming Istio 1.2, so some of this content may now be outdated.</div></aside></div><div><p>Welcome to part 3 in our series about secure control of egress traffic in Istio.
|
|
In <a href=/v1.21/blog/2019/egress-traffic-control-in-istio-part-1/>the first part in the series</a>, I presented the attacks involving
|
|
egress traffic and the requirements we collected for a secure control system for egress traffic.
|
|
In <a href=/v1.21/blog/2019/egress-traffic-control-in-istio-part-2/>the second part in the series</a>, I presented the Istio way of
|
|
securing egress traffic and showed how you can prevent the attacks using Istio.</p><p>In this installment, I compare secure control of egress traffic in Istio with alternative solutions such as using Kubernetes
|
|
network policies and legacy egress proxies and firewalls. Finally, I describe the performance considerations regarding the
|
|
secure control of egress traffic in Istio.</p><h2 id=alternative-solutions-for-egress-traffic-control>Alternative solutions for egress traffic control</h2><p>First, let’s remember the <a href=/v1.21/blog/2019/egress-traffic-control-in-istio-part-1/#requirements-for-egress-traffic-control>requirements for egress traffic control</a> we previously collected:</p><ol><li>Support of <a href=https://en.wikipedia.org/wiki/Transport_Layer_Security>TLS</a> with
|
|
<a href=https://en.wikipedia.org/wiki/Server_Name_Indication>SNI</a> or of <a href=/v1.21/docs/reference/glossary/#tls-origination>TLS origination</a>.</li><li><strong>Monitor</strong> SNI and the source workload of every egress access.</li><li>Define and enforce <strong>policies per cluster</strong>.</li><li>Define and enforce <strong>policies per source</strong>, <em>Kubernetes-aware</em>.</li><li><strong>Prevent tampering</strong>.</li><li>Traffic control is <strong>transparent</strong> to the applications.</li></ol><p>Next, I’m going to cover two alternative solutions for egress traffic control: the Kubernetes network policies and
|
|
egress proxies and firewalls. I show the requirements they satisfy, and, more importantly, the requirements they can’t satisfy.</p><p>Kubernetes provides a native solution for traffic control, and in particular, for control of egress traffic, through the <a href=https://kubernetes.io/docs/concepts/services-networking/network-policies/>network policies</a>.
|
|
Using these network policies, cluster operators can configure which pods can access specific external services.
|
|
Cluster operators can identify pods by pod labels, namespace labels, or by IP ranges. To specify the external services, cluster operators can use IP ranges, but cannot use domain names like <code>cnn.com</code>. This is because <strong>Kubernetes network policies are not DNS-aware</strong>.
|
|
Network policies satisfy the first requirement since they can control any TCP traffic.
|
|
Network policies only partially satisfy the third and the fourth requirements because cluster operators can specify policies
|
|
per cluster or per pod but operators can’t identify external services by domain names.
|
|
Network policies only satisfy the fifth requirement if the attackers are not able to break from a malicious container into the Kubernetes
|
|
node and interfere with the implementation of the policies inside said node.
|
|
Lastly, network policies do satisfy the sixth requirement: Operators don’t need to change the code or the
|
|
container environment. In summary, we can say that Kubernetes Network Policies provide transparent, Kubernetes-aware egress traffic
|
|
control, which is not DNS-aware.</p><p>The second alternative predates the Kubernetes network policies. Using a <strong>DNS-aware egress proxy or firewall</strong> lets you
|
|
configure applications to direct the traffic to the proxy and use some proxy protocol, for example,
|
|
<a href=https://en.wikipedia.org/wiki/SOCKS>SOCKS</a>.
|
|
Since operators must configure the applications, this solution is not transparent. Moreover, operators can’t use
|
|
pod labels or pod service accounts to configure the proxies because the egress proxies don’t know about them. Therefore, <strong>the egress proxies are not Kubernetes-aware</strong> and can’t fulfill the fourth requirement because
|
|
egress proxies cannot enforce policies by source if a Kubernetes artifact specifies the source.
|
|
In summary, egress proxies can fulfill the first, second, third and fifth requirements, but can’t satisfy the fourth and
|
|
the six requirements because they are not transparent and not Kubernetes-aware.</p><h2 id=advantages-of-istio-egress-traffic-control>Advantages of Istio egress traffic control</h2><p>Istio egress traffic control is <strong>DNS-aware</strong>: you can define policies based on URLs or on wildcard domains like
|
|
<code>*.ibm.com</code>. In this sense, it is better than Kubernetes network policies which are not DNS-aware.</p><p>Istio egress traffic control is <strong>transparent</strong> with regard to TLS traffic, since Istio is transparent:
|
|
you don’t need to change the applications or configure their containers.
|
|
For HTTP traffic with TLS origination, you must configure the applications in the mesh to use HTTP instead of HTTPS.</p><p>Istio egress traffic control is <strong>Kubernetes-aware</strong>: the identity of the source of egress traffic is based on
|
|
Kubernetes service accounts. Istio egress traffic control is better than the legacy DNS-aware proxies or firewalls which
|
|
are not transparent and not Kubernetes-aware.</p><p>Istio egress traffic control is <strong>secure</strong>: it is based on the strong identity of Istio and, when you
|
|
apply
|
|
<a href=/v1.21/docs/tasks/traffic-management/egress/egress-gateway/#additional-security-considerations>additional security measures</a>,
|
|
Istio’s traffic control is resilient to tampering.</p><p>Additionally, Istio’s egress traffic control provides the following advantages:</p><ul><li>Define access policies in the same language for ingress, egress, and in-cluster traffic. You
|
|
need to learn a single policy and configuration language for all types of traffic.</li><li>Out-of-the-Box integration of Istio’s egress traffic control with Istio’s policy and observability adapters.</li><li>Write the adapters to use external monitoring or access control systems with Istio only once and
|
|
apply them for all types of traffic: ingress, egress, and in-cluster.</li><li>Use Istio’s <a href=/v1.21/docs/concepts/traffic-management/>traffic management features</a> for egress traffic:
|
|
load balancing, passive and active health checking, circuit breaker, timeouts, retries, fault injection, and others.</li></ul><p>We refer to a system with the advantages above as <strong>Istio-aware</strong>.</p><p>The following table summarizes the egress traffic control features that Istio and the alternative solutions provide:</p><table><thead><tr><th></th><th>Istio Egress Traffic Control</th><th>Kubernetes Network Policies</th><th>Legacy Egress Proxy or Firewall</th></tr></thead><tbody><tr><td>DNS-aware</td><td><svg class="large-icon"><use xlink:href="/v1.21/img/icons.svg#checkmark"/></svg></td><td><svg class="large-icon"><use xlink:href="/v1.21/img/icons.svg#cancel"/></svg></td><td><svg class="large-icon"><use xlink:href="/v1.21/img/icons.svg#checkmark"/></svg></td></tr><tr><td>Kubernetes-aware</td><td><svg class="large-icon"><use xlink:href="/v1.21/img/icons.svg#checkmark"/></svg></td><td><svg class="large-icon"><use xlink:href="/v1.21/img/icons.svg#checkmark"/></svg></td><td><svg class="large-icon"><use xlink:href="/v1.21/img/icons.svg#cancel"/></svg></td></tr><tr><td>Transparent</td><td><svg class="large-icon"><use xlink:href="/v1.21/img/icons.svg#checkmark"/></svg></td><td><svg class="large-icon"><use xlink:href="/v1.21/img/icons.svg#checkmark"/></svg></td><td><svg class="large-icon"><use xlink:href="/v1.21/img/icons.svg#cancel"/></svg></td></tr><tr><td>Istio-aware</td><td><svg class="large-icon"><use xlink:href="/v1.21/img/icons.svg#checkmark"/></svg></td><td><svg class="large-icon"><use xlink:href="/v1.21/img/icons.svg#cancel"/></svg></td><td><svg class="large-icon"><use xlink:href="/v1.21/img/icons.svg#cancel"/></svg></td></tr></tbody></table><h2 id=performance-considerations>Performance considerations</h2><p>Controlling egress traffic using Istio has a price: increased latency of calls to external services and
|
|
increased CPU usage by the cluster’s pods.
|
|
Traffic passes through two proxies:</p><ul><li>The application’s sidecar proxy</li><li>The egress gateway’s proxy</li></ul><p>If you use <a href=/v1.21/docs/tasks/traffic-management/egress/wildcard-egress-hosts/>TLS egress traffic to wildcard domains</a>,
|
|
you must add
|
|
<a href=/v1.21/docs/tasks/traffic-management/egress/wildcard-egress-hosts/#wildcard-configuration-for-arbitrary-domains>an additional proxy</a>
|
|
between the application and the external service. Since the traffic between the egress gateway’s proxy and
|
|
the proxy needed for the configuration of arbitrary domains using wildcards is on the pod’s local
|
|
network, that traffic shouldn’t have a significant impact on latency.</p><p>See a <a href=/v1.21/blog/2019/egress-performance/>performance evaluation</a> of different Istio configurations set to control egress
|
|
traffic. I would encourage you to carefully measure different configurations with your own applications and your own
|
|
external services, before you decide whether you can afford the performance overhead for your use cases. You should weigh the
|
|
required level of security versus your performance requirements and compare the performance overhead of all
|
|
alternative solutions.</p><p>Let me share my thoughts on the performance overhead that controlling egress traffic using Istio adds:
|
|
Accessing external services already could have high latency and the overhead added
|
|
because of two or three proxies inside the cluster could likely not be very significant by comparison.
|
|
After all, applications with a microservice architecture can have chains of dozens of calls between microservices.
|
|
Therefore, an additional hop with one or two proxies in the egress gateway should not have a large impact.</p><p>Moreover, we continue to work towards reducing Istio’s performance overhead.
|
|
Possible optimizations include:</p><ul><li>Extending Envoy to handle wildcard domains: This would eliminate the need for a third proxy between
|
|
the application and the external services for that use case.</li><li>Using mutual TLS for authentication only without encrypting the TLS traffic, since the traffic is already
|
|
encrypted.</li></ul><h2 id=summary>Summary</h2><p>I hope that after reading this series you are convinced that controlling egress traffic is very important for the
|
|
security of your cluster.
|
|
Hopefully, I also managed to convince you that Istio is an effective tool to control egress traffic
|
|
securely, and that Istio has multiple advantages over the alternative solutions.
|
|
Istio is the only solution I’m aware of that lets you:</p><ul><li>Control egress traffic in a secure and transparent way</li><li>Specify external services as domain names</li><li>Use Kubernetes artifacts to specify the traffic source</li></ul><p>In my opinion, secure control of egress traffic is a great choice if you are looking for your first Istio use case.
|
|
In this case, Istio already provides you some benefits even before you start using all other Istio features:
|
|
<a href=/v1.21/docs/tasks/traffic-management/>traffic management</a>, <a href=/v1.21/docs/tasks/security/>security</a>,
|
|
<a href=https://istio.io/v1.6/docs/tasks/policy-enforcement/>policies</a> and <a href=/v1.21/docs/tasks/observability/>observability</a>, applied to traffic between
|
|
microservices inside the cluster.</p><p>So, if you haven’t had the chance to work with Istio yet, <a href=/v1.21/docs/setup/install/>install Istio</a> on your cluster
|
|
and check our <a href=/v1.21/docs/tasks/traffic-management/egress/>egress traffic control tasks</a> and the tasks for the other
|
|
<a href=/v1.21/docs/tasks/>Istio features</a>. We also want to hear from you, please join us at <a href=https://discuss.istio.io>discuss.istio.io</a>.</p></div><nav class=pagenav><div class=left><a title="The design principles behind Istio's APIs and how those APIs are evolving." href=/v1.21/blog/2019/evolving-istios-apis/ class=next-link><svg class="icon left-arrow"><use xlink:href="/v1.21/img/icons.svg#left-arrow"/></svg>The Evolution of Istio's APIs</a></div><div class=right><a title="Use Istio Egress Traffic Control to prevent attacks involving egress traffic." href=/v1.21/blog/2019/egress-traffic-control-in-istio-part-2/ class=next-link>Secure Control of Egress Traffic in Istio, part 2<svg class="icon right-arrow"><use xlink:href="/v1.21/img/icons.svg#right-arrow"/></svg></a></div></nav></article><footer class=footer><div class="footer-wrapper container-l"><div class="user-links footer-links"><a class=channel title='GitHub is where development takes place on Istio code' href=https://github.com/istio/community aria-label=GitHub><svg class="icon github"><use xlink:href="/v1.21/img/icons.svg#github"/></svg>
|
|
</a><a class=channel title="Access our team drive if you'd like to take a look at the Istio technical design documents" href=https://groups.google.com/forum/#!forum/istio-team-drive-access aria-label="team drive"><svg class="icon drive"><use xlink:href="/v1.21/img/icons.svg#drive"/></svg>
|
|
</a><a class=channel title='Interactively discuss issues with the Istio community on Slack' href=https://slack.istio.io aria-label=slack><svg class="icon slack"><use xlink:href="/v1.21/img/icons.svg#slack"/></svg>
|
|
</a><a class=channel title='Stack Overflow is where you can ask questions and find curated answers on deploying, configuring, and using Istio' href=https://stackoverflow.com/questions/tagged/istio aria-label="Stack Overflow"><svg class="icon stackoverflow"><use xlink:href="/v1.21/img/icons.svg#stackoverflow"/></svg>
|
|
</a><a class=channel title='Follow us on Twitter to get the latest news' href=https://twitter.com/IstioMesh aria-label=Twitter><svg class="icon twitter"><use xlink:href="/v1.21/img/icons.svg#twitter"/></svg></a></div><hr class=footer-separator role=separator><div class="info footer-info"><a class=logo href=/v1.21/ aria-label=logotype><svg xmlns="http://www.w3.org/2000/svg" width="128" height="60" viewBox="0 0 128 60"><path d="M58.434 48.823A.441.441.0 0158.3 48.497V22.583a.444.444.0 01.134-.326.446.446.0 01.327-.134h3.527a.447.447.0 01.325.134.447.447.0 01.134.326v25.914a.443.443.0 01-.134.326.444.444.0 01-.325.134h-3.527a.444.444.0 01-.327-.134z"/><path d="m70.969 48.477a6.556 6.556.0 01-2.818-1.955 4.338 4.338.0 01-1-2.78v-.345a.443.443.0 01.134-.326.444.444.0 01.326-.135h3.374a.444.444.0 01.326.135.445.445.0 01.134.326v.077a2.014 2.014.0 001.054 1.667 4.672 4.672.0 002.664.709 4.446 4.446.0 002.492-.633 1.862 1.862.0 00.958-1.591 1.426 1.426.0 00-.786-1.322 12.7 12.7.0 00-2.549-.939l-1.457-.46a21.526 21.526.0 01-3.3-1.227 6.57 6.57.0 01-2.262-1.783 4.435 4.435.0 01-.92-2.894 5.081 5.081.0 012.109-4.275 8.993 8.993.0 015.558-1.591 10.445 10.445.0 014.1.748 6.3 6.3.0 012.722 2.07 5 5 0 01.958 3.009.441.441.0 01-.134.326.441.441.0 01-.325.134h-3.258a.441.441.0 01-.326-.134.443.443.0 01-.134-.326 1.974 1.974.0 00-.978-1.667 4.647 4.647.0 00-2.665-.671 4.741 4.741.0 00-2.435.556 1.724 1.724.0 00-.938 1.553 1.512 1.512.0 00.9 1.4 15.875 15.875.0 003.01 1.055l.843.229a27.368 27.368.0 013.412 1.246 6.67 6.67.0 012.338 1.763 4.387 4.387.0 01.958 2.933 4.988 4.988.0 01-2.146 4.275 9.543 9.543.0 01-5.712 1.552 11.626 11.626.0 01-4.227-.709z"/><path d="m97.039 32.837a.443.443.0 01-.326.135h-3.911a.169.169.0 00-.191.192v9.239a2.951 2.951.0 00.632 2.108 2.7 2.7.0 002.013.652h1.15a.444.444.0 01.325.134.441.441.0 01.134.326v2.875a.471.471.0 01-.459.5l-1.994.039a8 8 0 01-4.524-1.035q-1.495-1.035-1.533-3.91V33.166A.17.17.0 0088.164 32.974H85.978A.441.441.0 0185.652 32.839.441.441.0 0185.518 32.513V29.83a.441.441.0 01.134-.326.444.444.0 01.326-.135h2.186a.169.169.0 00.191-.192v-4.485a.438.438.0 01.134-.326.44.44.0 01.325-.134h3.336a.443.443.0 01.325.134.442.442.0 01.135.326v4.485a.169.169.0 00.191.192h3.911a.446.446.0 01.326.135.446.446.0 01.134.326v2.683a.446.446.0 01-.133.324z"/><path d="m101.694 25.917a2.645 2.645.0 01-.767-1.955 2.65 2.65.0 01.767-1.955 2.65 2.65.0 011.955-.767 2.65 2.65.0 011.955.767 2.652 2.652.0 01.767 1.955 2.647 2.647.0 01-.767 1.955 2.646 2.646.0 01-1.955.767 2.645 2.645.0 01-1.955-.767zm-.211 22.906a.441.441.0 01-.134-.326V29.79a.444.444.0 01.134-.326.446.446.0 01.326-.134h3.527a.446.446.0 01.326.134.445.445.0 01.134.326v18.707a.443.443.0 01-.134.326.443.443.0 01-.326.134h-3.527a.443.443.0 01-.326-.134z"/><path d="m114.019 47.734a8.1 8.1.0 01-3.047-4.255 14.439 14.439.0 01-.652-4.37 14.3 14.3.0 01.614-4.371A7.869 7.869.0 01114 30.56a9.072 9.072.0 015.252-1.5 8.543 8.543.0 015.041 1.5 7.985 7.985.0 013.009 4.14 12.439 12.439.0 01.69 4.37 13.793 13.793.0 01-.651 4.37 8.255 8.255.0 01-3.028 4.275 8.475 8.475.0 01-5.1 1.553 8.754 8.754.0 01-5.194-1.534zm7.629-3.1a4.536 4.536.0 001.476-2.262 11.335 11.335.0 00.383-3.221 10.618 10.618.0 00-.383-3.22 4.169 4.169.0 00-1.457-2.243 4.066 4.066.0 00-2.531-.785 3.942 3.942.0 00-2.453.785 4.376 4.376.0 00-1.5 2.243 11.839 11.839.0 00-.383 3.22 11.84 11.84.0 00.383 3.221 4.222 4.222.0 001.476 2.262 4.075 4.075.0 002.549.8 3.8 3.8.0 002.44-.809z"/><path d="m15.105 32.057v15.565a.059.059.0 01-.049.059L.069 50.25A.06.06.0 01.005 50.167l14.987-33.47a.06.06.0 01.114.025z"/><path d="m17.631 23.087v24.6a.06.06.0 00.053.059l22.449 2.507a.06.06.0 00.061-.084L17.745.032a.06.06.0 00-.114.024z"/><path d="m39.961 52.548-24.833 7.45a.062.062.0 01-.043.0L.079 52.548a.059.059.0 01.026-.113h39.839a.06.06.0 01.017.113z"/></svg></a><div class=footer-languages><a tabindex=-1 lang=en id=switch-lang-en class="footer-languages-item active"><svg class="icon tick"><use xlink:href="/v1.21/img/icons.svg#tick"/></svg>
|
|
English
|
|
</a><a tabindex=-1 lang=zh id=switch-lang-zh class=footer-languages-item>中文</a></div></div><ul class=footer-policies><li class=footer-policies-item><a class=footer-policies-link href=https://www.linuxfoundation.org/legal/terms>Terms and Conditions
|
|
</a>|
|
|
<a class=footer-policies-link href=https://www.linuxfoundation.org/legal/privacy-policy>Privacy policy
|
|
</a>|
|
|
<a class=footer-policies-link href=https://www.linuxfoundation.org/legal/trademark-usage>Trademarks
|
|
</a>|
|
|
<a class=footer-policies-link href=https://github.com/istio/istio.io/edit/release-1.21/content/en/index>Edit this Page on GitHub</a></li></ul><div class=footer-base><span class=footer-base-copyright>© 2024 the Istio Authors.</span>
|
|
<span class=footer-base-version>Version
|
|
Archive
|
|
1.21.2</span><ul class=footer-base-releases><li class=footer-base-releases-item><a tabindex=-1 class=footer-base-releases-link onclick='return navigateToUrlOrRoot("https://istio.io/blog/2019/egress-traffic-control-in-istio-part-3/"),!1'>current release</a></li><li class=footer-base-releases-item><a tabindex=-1 class=footer-base-releases-link onclick='return navigateToUrlOrRoot("https://preliminary.istio.io/blog/2019/egress-traffic-control-in-istio-part-3/"),!1'>next release</a></li><li class=footer-base-releases-item><a tabindex=-1 class=footer-base-releases-link href=https://istio.io/archive>older releases</a></li></ul></div></div></footer><div id=scroll-to-top-container aria-hidden=true><button id=scroll-to-top title='Back to top' tabindex=-1><svg class="icon top"><use xlink:href="/v1.21/img/icons.svg#top"/></svg></button></div></body></html> |