mirror of https://github.com/istio/istio.io.git
131 lines
24 KiB
HTML
131 lines
24 KiB
HTML
<!doctype html><html lang=en itemscope itemtype=https://schema.org/WebPage><head><meta charset=utf-8><meta http-equiv=x-ua-compatible content="IE=edge"><meta name=viewport content="width=device-width,initial-scale=1,shrink-to-fit=no"><meta name=theme-color content="#466BB0"><meta name=title content="Security FAQ"><meta name=description content="Security Q & A."><meta name=keywords content="microservices,services,mesh"><meta property="og:title" content="Security FAQ"><meta property="og:type" content="website"><meta property="og:description" content="Security Q & A."><meta property="og:url" content="/v1.8/faq/security/"><meta property="og:image" content="/v1.8/img/istio-whitelogo-bluebackground-framed.svg"><meta property="og:image:alt" content="Istio Logo"><meta property="og:image:width" content="112"><meta property="og:image:height" content="150"><meta property="og:site_name" content="Istio"><meta name=twitter:card content="summary"><meta name=twitter:site content="@IstioMesh"><title>Istioldie 1.8 / Security FAQ</title><script async src="https://www.googletagmanager.com/gtag/js?id=UA-98480406-2"></script><script>window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}
|
|
gtag('js',new Date());gtag('config','UA-98480406-2');</script><link rel=alternate type=application/rss+xml title="Istio Blog" href=/v1.8/blog/feed.xml><link rel=alternate type=application/rss+xml title="Istio News" href=/v1.8/news/feed.xml><link rel=alternate type=application/rss+xml title="Istio Blog and News" href=/v1.8/feed.xml><link rel="shortcut icon" href=/v1.8/favicons/favicon.ico><link rel=apple-touch-icon href=/v1.8/favicons/apple-touch-icon-180x180.png sizes=180x180><link rel=icon type=image/png href=/v1.8/favicons/favicon-16x16.png sizes=16x16><link rel=icon type=image/png href=/v1.8/favicons/favicon-32x32.png sizes=32x32><link rel=icon type=image/png href=/v1.8/favicons/android-36x36.png sizes=36x36><link rel=icon type=image/png href=/v1.8/favicons/android-48x48.png sizes=48x48><link rel=icon type=image/png href=/v1.8/favicons/android-72x72.png sizes=72x72><link rel=icon type=image/png href=/v1.8/favicons/android-96x96.png sizes=96xW96><link rel=icon type=image/png href=/v1.8/favicons/android-144x144.png sizes=144x144><link rel=icon type=image/png href=/v1.8/favicons/android-192x192.png sizes=192x192><link rel=manifest href=/v1.8/manifest.json><meta name=apple-mobile-web-app-title content="Istio"><meta name=application-name content="Istio"><link rel=stylesheet href="https://fonts.googleapis.com/css?family=Work+Sans:400|Chivo:400|Work+Sans:500,300,600,300italic,400italic,500italic,600italic|Chivo:500,300,600,300italic,400italic,500italic,600italic"><link rel=stylesheet href=/v1.8/css/all.css><script src=/v1.8/js/themes_init.min.js></script></head><body class="language-unknown archive-site"><script>const branchName="release-1.8";const docTitle="Security FAQ";const iconFile="\/v1.8/img/icons.svg";const buttonCopy='Copy to clipboard';const buttonPrint='Print';const buttonDownload='Download';</script><script src="https://www.google.com/cse/brand?form=search-form" defer></script><script src=/v1.8/js/all.min.js data-manual defer></script><header><nav><a id=brand href=/v1.8/><span class=logo><svg viewBox="0 0 300 300"><circle cx="150" cy="150" r="146" stroke-width="2"/><polygon points="65 240 225 240 125 270"/><polygon points="65 230 125 220 125 110"/><polygon points="135 220 225 230 135 30"/></svg></span><span class=name>Istioldie 1.8</span></a><div id=hamburger><svg class="icon hamburger"><use xlink:href="/v1.8/img/icons.svg#hamburger"/></svg></div><div id=header-links><a title="Learn how to deploy, use, and operate Istio." href=/v1.8/docs/>Docs</a>
|
|
<a title="Posts about using Istio." href=/v1.8/blog/2020/>Blog<i class=dot data-prefix=/blog></i></a>
|
|
<a title="Timely news about the Istio project." href=/v1.8/news/>News<i class=dot data-prefix=/news></i></a>
|
|
<a class=current title="Frequently Asked Questions about Istio." href=/v1.8/faq/>FAQ</a>
|
|
<a title="Get a bit more in-depth info about the Istio project." href=/v1.8/about/>About</a><div class=menu><button id=gearDropdownButton class=menu-trigger title="Options and settings" aria-label="Options and Settings" aria-controls=gearDropdownContent><svg class="icon gear"><use xlink:href="/v1.8/img/icons.svg#gear"/></svg></button><div id=gearDropdownContent class=menu-content aria-labelledby=gearDropdownButton role=menu><a tabindex=-1 role=menuitem lang=en id=switch-lang-en class=active>English</a>
|
|
<a tabindex=-1 role=menuitem lang=zh id=switch-lang-zh>中文</a><div role=separator></div><a tabindex=-1 role=menuitem class=active id=light-theme-item>Light Theme</a>
|
|
<a tabindex=-1 role=menuitem id=dark-theme-item>Dark Theme</a><div role=separator></div><a tabindex=-1 role=menuitem id=syntax-coloring-item>Color Examples</a><div role=separator></div><h6>Other versions of this site</h6><a tabindex=-1 role=menuitem onclick="navigateToUrlOrRoot('https://istio.io/faq\/security\/');return false;">Current Release</a>
|
|
<a tabindex=-1 role=menuitem onclick="navigateToUrlOrRoot('https://preliminary.istio.io/faq\/security\/');return false;">Next Release</a>
|
|
<a tabindex=-1 role=menuitem href=https://istio.io/archive>Older Releases</a></div></div><button id=search-show title="Search this site" aria-label=Search><svg class="icon magnifier"><use xlink:href="/v1.8/img/icons.svg#magnifier"/></svg></button></div><form id=search-form name=cse role=search><input type=hidden name=cx value=002184991200833970123:iwwf17ikgf4>
|
|
<input type=hidden name=ie value=utf-8>
|
|
<input type=hidden name=hl value=en>
|
|
<input type=hidden id=search-page-url value=/v1.8/search>
|
|
<input id=search-textbox class=form-control name=q type=search aria-label="Search this site">
|
|
<button id=search-close title="Cancel search" type=reset aria-label="Cancel search"><svg class="icon cancel-x"><use xlink:href="/v1.8/img/icons.svg#cancel-x"/></svg></button></form></nav></header><div class=banner-container></div><main class="primary notoc"><div id=sidebar-container class="sidebar-container sidebar-offcanvas"><nav id=sidebar aria-label="Section Navigation"><div class=directory><div class=card><div id=header0 class=header title="Frequently Asked Questions about Istio."><svg class="icon faq"><use xlink:href="/v1.8/img/icons.svg#faq"/></svg>FAQ</div><div class="body default" aria-labelledby=header0><ul role=tree aria-expanded=true class=leaf-section aria-labelledby=header0><li role=none><a role=treeitem title="General Q & A." href=/v1.8/faq/general/>General</a></li><li role=none><a role=treeitem title="Setup Q & A." href=/v1.8/faq/setup/>Setup</a></li><li role=none><a role=treeitem title="Application Specific Q & A." href=/v1.8/faq/applications/>Applications</a></li><li role=none><span role=treeitem class=current title="Security Q & A.">Security</span></li><li role=none><a role=treeitem title="Metrics and Logs Q & A." href=/v1.8/faq/metrics-and-logs/>Metrics and Logs</a></li><li role=none><a role=treeitem title="Distributed Tracing Q & A." href=/v1.8/faq/distributed-tracing/>Distributed Tracing</a></li><li role=none><a role=treeitem title="Traffic Management Q & A." href=/v1.8/faq/traffic-management/>Traffic Management</a></li></ul></div></div></div></nav></div><div class=article-container><nav aria-label=Breadcrumb><ol><li><a href=/v1.8/ title="Connect, secure, control, and observe services.">Istio</a></li><li><a href=/v1.8/faq/ title="Frequently Asked Questions about Istio.">FAQ</a></li><li>Security</li></ol></nav><article aria-labelledby=title><div class=title-area><i class=title-icon><svg class="icon faq"><use xlink:href="/v1.8/img/icons.svg#faq"/></svg></i><div style=width:100%><h1 id=title>Security FAQ</h1></div></div><nav class="toc-inlined toc-forced"><hr><div class=directory role=directory><nav id=InlineTableOfContents><ol><li role=none aria-label="How can I enable/disable mutual TLS after I installed Istio?"><a href=#enabling-disabling-mtls>How can I enable/disable mutual TLS after I installed Istio?</a></li><li role=none aria-label="Can I enable mutual TLS for some services while leaving it disabled for other services in the same cluster?"><a href=#auth-mix-and-match>Can I enable mutual TLS for some services while leaving it disabled for other services in the same cluster?</a></li><li role=none aria-label="How can I verify that traffic is using mutual TLS encryption?"><a href=#verify-mtls-encryption>How can I verify that traffic is using mutual TLS encryption?</a></li><li role=none aria-label="If mutual TLS is globally enabled, can non-Istio services access Istio services?"><a href=#non-istio-to-istio>If mutual TLS is globally enabled, can non-Istio services access Istio services?</a></li><li role=none aria-label="How can services that use Istio access non-Istio services?"><a href=#accessing-non-istio-services>How can services that use Istio access non-Istio services?</a></li><li role=none aria-label="How can I use Kubernetes liveness and readiness for pod health checks when mutual TLS is enabled?"><a href=#k8s-health-checks>How can I use Kubernetes liveness and readiness for pod health checks when mutual TLS is enabled?</a></li><li role=none aria-label="How to configure the lifetime for Istio certificates?"><a href=#cert-lifetime-config>How to configure the lifetime for Istio certificates?</a></li><li role=none aria-label="MySQL Connectivity Troubleshooting"><a href=#mysql-with-mtls>MySQL Connectivity Troubleshooting</a></li><li role=none aria-label="Does Istio support authorization?"><a href=#does-istio-support-authorization>Does Istio support authorization?</a></li><li role=none aria-label="Does Istio authentication use Kubernetes secrets?"><a href=#use-k8s-secrets>Does Istio authentication use Kubernetes secrets?</a></li><li role=none aria-label="Is the secret encrypted for workload key and cert?"><a href=#secret-encryption>Is the secret encrypted for workload key and cert?</a></li><li role=none aria-label="How to configure Istio Ingress to only accept TLS traffic?"><a href=#secure-ingress>How to configure Istio Ingress to only accept TLS traffic?</a></li><li role=none aria-label="Can I install Istio sidecar for HTTPS services?"><a href=#https-overlay>Can I install Istio sidecar for HTTPS services?</a></li></ol></nav></div><hr></nav><div class=faq><h5 id=enabling-disabling-mtls class=question>How can I enable/disable mutual TLS after I installed Istio?</h5><div class=answer><p>You can change mutual TLS settings for your services at any time using <a href=/v1.8/docs/concepts/security/#authentication-policies>authentication policy</a>
|
|
and <a href=/v1.8/docs/concepts/traffic-management/#destination-rules>destination rule</a>. See <a href=/v1.8/docs/tasks/security/authentication/authn-policy>task</a> for more details.</p></div><h5 id=auth-mix-and-match class=question>Can I enable mutual TLS for some services while leaving it disabled for other services in the same cluster?</h5><div class=answer><p><a href=/v1.8/docs/concepts/security/#authentication-policies>Authentication policy</a> can be mesh-wide (which affects all services in the mesh), namespace-wide
|
|
(all services in the same namespace) or service specific. You can have policy or policies to setup mutual TLS for services in a cluster in any way as you want.</p></div><h5 id=verify-mtls-encryption class=question>How can I verify that traffic is using mutual TLS encryption?</h5><div class=answer><p>If you installed Istio with <code>values.global.proxy.privileged=true</code>, you can use <code>tcpdump</code> to determine encryption status. See <a href=/v1.8/docs/tasks/security/authentication/mtls-migration>Istio mutual TLS migration</a> for instructions.</p></div><h5 id=non-istio-to-istio class=question>If mutual TLS is globally enabled, can non-Istio services access Istio services?</h5><div class=answer><p>Non-Istio services cannot communicate to Istio services unless they can present a valid certificate, which is less likely to happen.
|
|
This is the expected behavior for <em>mutual TLS</em>. However, you can override the
|
|
global flag for specific namespaces or services. See
|
|
<a href=/v1.8/docs/tasks/security/authentication/authn-policy>task</a> for more details.</p></div><h5 id=accessing-non-istio-services class=question>How can services that use Istio access non-Istio services?</h5><div class=answer><p>Istio detects if the destination workload has an Envoy proxy and drops mutual TLS if it doesn’t. Set an explicit destination rule to disable mutual TLS. For example:</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ kubectl apply -f - <<EOF
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: DestinationRule
|
|
metadata:
|
|
name: "api-server"
|
|
spec:
|
|
host: "kubernetes.default.svc.cluster.local"
|
|
trafficPolicy:
|
|
tls:
|
|
mode: DISABLE
|
|
EOF
|
|
</code></pre></div><h5 id=k8s-health-checks class=question>How can I use Kubernetes liveness and readiness for pod health checks when mutual TLS is enabled?</h5><div class=answer><p>If mutual TLS is enabled, HTTP and TCP health checks from the kubelet will not work without modification, since the kubelet does not have Istio-issued certificates.</p><p>As of Istio 1.1, we have several options to solve this issue.</p><ol><li><p>Using probe rewrite to redirect liveness and readiness requests to the
|
|
workload directly. Please refer to <a href=/v1.8/docs/ops/configuration/mesh/app-health-check/#probe-rewrite>Probe Rewrite</a>
|
|
for more information.</p></li><li><p>Using a separate port for health checks and enabling mutual TLS only on the regular service port. Please refer to <a href=/v1.8/docs/ops/configuration/mesh/app-health-check/#separate-port>Health Checking of Istio Services</a> for more information.</p></li><li><p>Using the <a href=/v1.8/docs/tasks/security/authentication/mtls-migration><code>PERMISSIVE</code> mode</a> for Istio services so they can accept both HTTP and mutual TLS traffic. Please keep in mind that mutual TLS is not enforced since others can communicate with the service with HTTP traffic.</p></li><li><p>Using a <a href=https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#define-a-liveness-command>liveness command</a> for health checks, e.g., one can install <code>curl</code> in the service pod and
|
|
<code>curl</code> itself within the pod.</p></li></ol><p>An example of a readiness probe:</p><pre><code class=language-yaml data-expandlinks=true data-repo=istio>livenessProbe:
|
|
exec:
|
|
command:
|
|
- curl
|
|
- -f
|
|
- http://localhost:8080/healthz # Replace port and URI by your actual health check
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 5
|
|
</code></pre></div><h5 id=cert-lifetime-config class=question>How to configure the lifetime for Istio certificates?</h5><div class=answer><p>For the workloads running in Kubernetes, the lifetime of their Istio certificates is controlled by the
|
|
<code>workload-cert-ttl</code> flag on Citadel. The default value is 90 days. This value should be no greater than
|
|
<code>max-workload-cert-ttl</code> of Citadel.</p><p>Citadel uses a flag <code>max-workload-cert-ttl</code> to control the maximum lifetime for Istio certificates issued to
|
|
workloads. The default value is 90 days. If <code>workload-cert-ttl</code> on Citadel or the Istio Agent is greater than
|
|
<code>max-workload-cert-ttl</code>, Citadel will fail issuing the certificate.</p><p>You can modify a <a href=/v1.8/docs/setup/install/istioctl/#generate-a-manifest-before-installation>generated manifest</a>
|
|
file to customize the Citadel configuration.
|
|
The following modification specifies that the Istio certificates for workloads running in Kubernetes
|
|
has 1 hours lifetime. Besides that, the maximum allowed Istio certificate lifetime is 48 hours.</p><pre><code class=language-plain data-expandlinks=true data-repo=istio>...
|
|
kind: Deployment
|
|
...
|
|
metadata:
|
|
name: istio-citadel
|
|
namespace: istio-system
|
|
spec:
|
|
...
|
|
template:
|
|
...
|
|
spec:
|
|
...
|
|
containers:
|
|
- name: citadel
|
|
...
|
|
args:
|
|
- --workload-cert-ttl=1h # Lifetime of certificates issued to workloads in Kubernetes.
|
|
- --max-workload-cert-ttl=48h # Maximum lifetime of certificates issued to workloads by Citadel.
|
|
</code></pre><p>For the workloads running on VMs and bare metal hosts, the lifetime of their Istio certificates is specified by the
|
|
<code>workload-cert-ttl</code> flag on each Istio Agent. The default value is also 90 days. This value should be no greater than
|
|
<code>max-workload-cert-ttl</code> of Citadel.</p><p>To customize this configuration, the argument for the Istio Agent service should be modified.
|
|
After <a href=/v1.8/docs/examples/virtual-machines/single-network/#setting-up-the-vm>setting up the machines</a> for Istio
|
|
mesh expansion, modify the file <code>/lib/systemd/system/istio-auth-node-agent.service</code> on the VMs or bare metal hosts:</p><pre><code class=language-plain data-expandlinks=true data-repo=istio>...
|
|
[Service]
|
|
ExecStart=/usr/local/bin/node_agent --workload-cert-ttl=24h # Specify certificate lifetime for workloads on this machine.
|
|
Restart=always
|
|
StartLimitInterval=0
|
|
RestartSec=10
|
|
...
|
|
</code></pre><p>The above configuration specifies that the Istio certificates for workloads running on this VM or bare metal host
|
|
will have 24 hours lifetime.</p><p>After configuring the service, restart the Istio Agent by running <code>systemctl daemon-reload</code>.</p></div><h5 id=mysql-with-mtls class=question>MySQL Connectivity Troubleshooting</h5><div class=answer><p>You may find MySQL can’t connect after installing Istio. This is because of <code>PERMISSIVE</code> mode,
|
|
which is enabled in the <code>demo</code> <a href=/v1.8/docs/setup/additional-setup/config-profiles/>configuration profile</a>,
|
|
does not work with MySQL.
|
|
You may see error messages such as <code>ERROR 2013 (HY000): Lost connection to MySQL server at
|
|
'reading initial communication packet', system error: 0</code>.</p><p>There have two options to solve the problem.</p><ol><li><p>Disable Mutual TLS.</p><p>Choose this option if you don’t want Istio mutual TLS. You achieve this by disabling mutual TLS on the MySQL
|
|
service explicitly.</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ kubectl apply -f - <<EOF
|
|
apiVersion: security.istio.io/v1beta1
|
|
kind: PeerAuthentication
|
|
metadata:
|
|
name: mysql-nomtls-peerauthn
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: <YOUR-MYSQL-SERVICE> # The label of *your* K8s Service
|
|
mtls:
|
|
mode: DISABLE
|
|
EOF
|
|
</code></pre></li><li><p>Enable mutual TLS in STRICT mode.</p><p>If you want mutual TLS protection for MySQL, enable mutual TLS using a destination rule and an authentication policy.</p><pre><code class=language-bash data-expandlinks=true data-repo=istio>$ kubectl apply -f - <<EOF
|
|
apiVersion: security.istio.io/v1beta1
|
|
kind: PeerAuthentication
|
|
metadata:
|
|
name: mysql-mtls-peerauthn
|
|
spec:
|
|
selector:
|
|
matchLabels:
|
|
app: <YOUR-MYSQL-SERVICE> # The label of *your* K8s Service
|
|
mtls:
|
|
mode: STRICT
|
|
---
|
|
apiVersion: networking.istio.io/v1alpha3
|
|
kind: DestinationRule
|
|
metadata:
|
|
name: mysql-mtls-dr
|
|
spec:
|
|
host: YOUR-MYSQL-SERVICE # The name of *your* K8s Service
|
|
trafficPolicy:
|
|
tls:
|
|
mode: ISTIO_MUTUAL
|
|
EOF
|
|
</code></pre></li></ol></div><h5 id=does-istio-support-authorization class=question>Does Istio support authorization?</h5><div class=answer><p>Yes. Istio provides authorization features for both HTTP and plain TCP services in the mesh.
|
|
<a href=/v1.8/docs/concepts/security/#authorization>Learn more</a>.</p></div><h5 id=use-k8s-secrets class=question>Does Istio authentication use Kubernetes secrets?</h5><div class=answer><p>Yes. The key and certificate distribution in Istio Authentication is based on <a href=https://kubernetes.io/docs/concepts/configuration/secret/>Kubernetes secrets</a>.</p><p>Secrets have known <a href=https://kubernetes.io/docs/concepts/configuration/secret/#risks>security risks</a>. The Kubernetes team is working on
|
|
<a href=https://docs.google.com/document/d/1T2y-9geg9EfHHtCDYTXptCa-F4kQ0RyiH-c_M1SyD0s>several features</a> to improve
|
|
Kubernetes secret security, from secret encryption to node-level access control. And as of version 1.6, Kubernetes introduces
|
|
<a href=https://kubernetes.io/docs/reference/access-authn-authz/rbac/>RBAC authorization</a>, which can provide fine-grained secrets management.</p></div><h5 id=secret-encryption class=question>Is the secret encrypted for workload key and cert?</h5><div class=answer><p>By default, they are base64 encoded but not encrypted. However, the <a href=https://kubernetes.io/docs/tasks/administer-cluster/encrypt-data/>secret encryption feature</a> is supported in Kubernetes and you can do it by following the instruction.</p><p>Notice that this feature is not enabled yet in Google Container Engine (GKE). While the data may not be encrypted inside the etcd running on the master node, the contents of the master node itself are encrypted, see <a href=https://cloud.google.com/security/encryption-at-rest/default-encryption/#encryption_of_data_at_rest>here</a> for more info.</p></div><h5 id=secure-ingress class=question>How to configure Istio Ingress to only accept TLS traffic?</h5><div class=answer><p>By following the instructions in the
|
|
<a href=/v1.8/docs/tasks/traffic-management/ingress/secure-ingress>Secure Ingress Traffic</a> task,
|
|
Istio Ingress can be secured to only accept TLS traffic.</p></div><h5 id=https-overlay class=question>Can I install Istio sidecar for HTTPS services?</h5><div class=answer><p>Yes, you can. It works both with mutual TLS enabled and disabled.</p></div></div></article><nav class=pagenav><div class=left><a title="Application Specific Q & A." href=/v1.8/faq/applications/><svg class="icon left-arrow"><use xlink:href="/v1.8/img/icons.svg#left-arrow"/></svg>Applications</a></div><div class=right><a title="Metrics and Logs Q & A." href=/v1.8/faq/metrics-and-logs/>Metrics and Logs<svg class="icon right-arrow"><use xlink:href="/v1.8/img/icons.svg#right-arrow"/></svg></a></div></nav><div id=endnotes-container aria-hidden=true><h2>Links</h2><ol id=endnotes></ol></div></div></main><footer><div class=user-links><a class=channel title="Go download Istio 1.8.3 now" href=/v1.8/docs/setup/getting-started/#download aria-label="Download Istio"><span>download</span><svg class="icon download"><use xlink:href="/v1.8/img/icons.svg#download"/></svg>
|
|
</a><a class=channel title="Join the Istio discussion board to participate in discussions and get help troubleshooting problems" href=https://discuss.istio.io aria-label="Istio discussion board"><span>discuss</span><svg class="icon discourse"><use xlink:href="/v1.8/img/icons.svg#discourse"/></svg></a>
|
|
<a class=channel title="Stack Overflow is where you can ask questions and find curated answers on deploying, configuring, and using Istio" href=https://stackoverflow.com/questions/tagged/istio aria-label="Stack Overflow"><span>stack overflow</span><svg class="icon stackoverflow"><use xlink:href="/v1.8/img/icons.svg#stackoverflow"/></svg></a>
|
|
<a class=channel title="Interactively discuss issues with the Istio community on Slack" href=https://slack.istio.io aria-label=slack><span>slack</span><svg class="icon slack"><use xlink:href="/v1.8/img/icons.svg#slack"/></svg></a>
|
|
<a class=channel title="Follow us on Twitter to get the latest news" href=https://twitter.com/IstioMesh aria-label=Twitter><span>twitter</span><svg class="icon twitter"><use xlink:href="/v1.8/img/icons.svg#twitter"/></svg></a><div class=tag>for everyone</div></div><div class=info><p class=copyright>Istio Archive
|
|
1.8.3<br>© 2020 Istio Authors, <a href=https://policies.google.com/privacy>Privacy Policy</a><br>Archived on February 9, 2021</p></div><div class=dev-links><a class=channel title="GitHub is where development takes place on Istio code" href=https://github.com/istio/community aria-label=GitHub><span>github</span><svg class="icon github"><use xlink:href="/v1.8/img/icons.svg#github"/></svg></a>
|
|
<a class=channel title="Access our team drive if you'd like to take a look at the Istio technical design documents" href=https://groups.google.com/forum/#!forum/istio-team-drive-access aria-label="team drive"><span>drive</span><svg class="icon drive"><use xlink:href="/v1.8/img/icons.svg#drive"/></svg></a>
|
|
<a class=channel title="If you'd like to contribute to the Istio project, consider participating in our working groups" href=https://github.com/istio/community/blob/master/WORKING-GROUPS.md aria-label="working groups"><span>working groups</span><svg class="icon working-groups"><use xlink:href="/v1.8/img/icons.svg#working-groups"/></svg></a><div class=tag>for developers</div></div></footer><div id=scroll-to-top-container aria-hidden=true><button id=scroll-to-top title="Back to top"><svg class="icon top"><use xlink:href="/v1.8/img/icons.svg#top"/></svg></button></div></body></html> |