►
From YouTube: What's a Zero-Trust Tunnel? Exploring Security and Simpler Operations w... Jim Barton & Marino Wijay
Description
Don't miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe in Amsterdam, The Netherlands from 18 - 21 April, 2023. Learn more at https://kubecon.io The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
What's a Zero-Trust Tunnel? Exploring Security and Simpler Operations with Istio Ambient Mesh - Jim Barton & Marino Wijay, Solo.io
One of the most common drivers for service mesh adoption is security compliance. Large enterprises in heavily regulated industries or the public sector must adopt practices like a zero-trust security posture both inside and at the edge of its application networks. Service mesh platforms like CNCF's Istio project are growing in popularity as a vehicle for meeting these challenges. In September 2022, Google and Solo.io announced the release of Istio Ambient Mesh to the community. Ambient offers a revolutionary data-plane architecture that allows service mesh users to ditch sidecars. It delivers an enhanced security posture while slashing operational complexity and enabling incremental mesh adoption, all while reducing cost and computational overhead within a service mesh. This talk will review the new sidecar-less architectural option available with Ambient. We'll discuss the two new complementary layers: a zero-trust tunnel (ztunnel) that secures Layer 4 connectivity, and a waypoint proxy that delivers Layer 7 security policies and behaviors. A demonstration will illustrate how these new components work together in practice.
B
A
Awesome
I'm,
Marino,
wijay
I
am
a
platform
Advocate
at
solo.
There's
a
lot
of
things
you
could
do.
You
could
follow
me
if
you
want,
but
one
thing
I
will
say
is
if
you're
kind
of
new
to
the
istio
journey
or
the
service
semester
journey
I
run
something
called
70
days
of
service
mesh
and
I'm
doing
this
on
GitHub
you
can
follow
along
I,
basically
will
dive
into
various
topics
of
the
world
of
service,
mesh
and
istio,
and
even
application
networking
so
go
check
that
out,
but
we're
going
to
dive
right
into
it.
A
So,
for
example,
sometimes
you
may
be
experiencing
things
like
a
race
condition
between
one
of
your
applications
trying
to
come
online
before
a
sidecar
comes
online,
so
you
can't
quite
get
your
application
up
and
online,
so
you
have
to
tune
this
and
set
something
like
a
there's.
A
field
called
the
hold
application
timer
within
your
deployment,
so
that
you
can
ensure
that
your
sidecar
comes
up
online.
First,
there's
also
some
other
elements
like
the
server
send.
First
protocols
like
SQL
and
other.
A
A
What
we're
really
here
to
talk
about
the
zero
trust
tunnel
is
what's
doing
a
lot
of
the
activity
for
tunneling
requests
between
one
particular
service
over
to
another
service,
maybe
within
the
same
node
or
in
another
node.
Now.
The
reality
here
is
that
you
know
not
all
applications
are
going
to
require
the
sidecar.
Some
will
require
the
sidecar,
but
not
only
that
what
what
happens
when
you
need
some
sort
of
layer,
7
style
of
policy.
A
So
we
deploy
something
called
a
cni
node
pod
that
is
deployed
as
a
Daemon
set
alongside
the
Z
tunnel.
The
Z
tunnel
is
also
deployed
as
a
Daemon
set.
Now,
if
you've
ever
worked
with
ipsec
before
there's
something
interesting
that
goes
on,
you
have
to
Define
an
access
control
list
that
tells
the
tunnel
hey.
This
is
the
traffic
we're
going
to
encrypt
this?
Is
the
source
traffic
we're
going
to
encrypt?
This
is
how
we
also
operate
in
the
world
of
ambient
mesh.
A
We
have
traffic
that
is
tagged
towards
the
Z
tunnel,
pod,
that's
going
to
Tunnel
over
to
another
node
and
once
we've
identified
what
that
traffic
is
it's
encrypted,
it's
sent
across
the
tunnel
and
it
gets
to
its
destination,
so
the
same
process
flows
for
when
we're
having
to
do
this
with-
let's
say
a
waypoint
proxy,
but
we'll
talk
a
little
bit
more
about
that
shortly.
But
when
we
look
at
it
at
a
deeper
level,
we
have
two
Services
service:
a
and
service
B.
When
I
have
traffic,
that's
destined
from
service
a
to
service
B.
A
A
This
way
when
your
traffic
or
your
requests
are
going
through
they're
going
to
still
maintain
their
their
encryption
all
the
way
through
to
the
the
destination
now
actually
one
other
thing
I
will
point
out,
though,
is
that
this
is
strictly
layer
four.
So
if
I'm
just
doing
strictly
or
four
Communications,
TCP
or
UDP
style
of
communications,
then
I
only
need
the
Z
tunnel
object
or
the
the
Z
tunnel
pod
that
gets
deployed
per
node
when
I
need,
when
I
need
layer,
7
authorization,
for
example.
This
is
where
the
Waypoint
proxy
comes
in.
A
We
deploy
this
at
the
destination
side
so
that
as
traffic
is
coming
in
or
as
layer
7
requests
are
coming
in.
That
Waypoint
proxy
is
supposed
to
sit
there
and
analyze
those
requests
and
then
we'll
allow
that
request
to
flow
through
or
deny
it
altogether
or
provide
some
sort
of
response
to
the
originator.
Now.
A
The
other
interesting
thing,
though,
about
the
Waypoint
proxy,
is
that
it
actually
makes
use
of
the
Gateway
API
spec
in
kubernetes,
so
you
specify
a
Gateway
class,
which
I
think
Jim
is
going
to
show
you
a
little
bit
later
on
when
we
get
into
the
demo
and
that
acts
as
our
enforcement
point
for
layer
7.
now.
One
other
interesting
thing
about
this
is
that
the
Waypoint
proxy
still
uses
Envoy,
because
Envoy
is
the
most
performant
layer,
7
proxy,
that
we
know
of
and
that
we've
used
alongside
istio
for
a
very
very
long
time.
A
Now.
What
are
the
benefits
of
using
ambient
mesh?
So
you
cut
back
on
Race
conditions
like
I
mentioned
earlier
on,
but
then
you
also
have
to
think
about
this.
This
idea
of
sidecar
injection
it
no
longer
is
there,
which
means
that
you
can
easily
onboard
Services
into
a
mesh
without
having
to
roll
them
out
again
and
restart
that
deployment.
The
other
thing,
too,
is
when
you
have
to
upgrade,
let's
say
a
sidecar,
or
now
more
specifically
a
z
tunnel
you're
not
having
to
do
this
on
a
per
pod
basis.
A
A
The
other
thing,
too,
is
with
respect
to
cost
savings
and
resource
consumption,
because
you're
not
deploying
sidecar
resources
everywhere,
and
only
where
you
need
it,
you're
now
consuming
less
CPU
and
memory
and
even
not
having
to
worry
about
the
additional
configuration
that
goes
alongside
those
services,
and
then
this
all
of
this
actually
works
to
contribute
to
providing
that
zero
trust.
Network.
A
Now,
let's
take
a
quick
look
at
things
like
how
do
we
derive
identity
and
what
actually
goes
on
with
this
tunneling
so
like
I,
previously
showed
you
I
have
a
service
service,
a
or
apple
that's
trying
to
communicate
with
app
B
over
on
the
right
hand,
side.
Now
we
already
know
that,
because
these
two
workloads
are
tagged
for
ambient
based
traffic
or
ambient
based
workloads,
we
already
know
to
put
that
traffic
or
that
request
into
the
Z
tunnel
and
then
encrypt
it
with
mtls.
A
The
other
thing,
though,
is
that
you
know
what
is
this
tunnel
like:
where
did
this
tunnel
come
from?
So
there
was
a
lot
of
engineering
effort
that
went
in
to
create
this
new
overlay
called
h-bone
or
the
HTTP
based
overlay,
Network
encapsulation,
and
what
this
provides
is
a
a
TCP
over
HTTP
mechanism
so
that
you
can
carry
your
your
requests
over
this
overlay
Network
or
this
overlay
tunnel.
Now
this
is
occurring
from
Z
tunnel
pod
to
Z
tunnel
pod.
So
remember
we
deploy
a
z-tunnel
pod
at
a
Daemon
set
level.
A
So
if
you're,
no
sorry,
if
your
cluster,
your
kubernetes
cluster,
has
you
know
10
nodes,
each
one
of
those
nodes
is
going
to
get
a
z
tunnel
pod,
which
means
that
each
one
of
those
Z
tunnel
pods
is
going
to
tunnel
to
each
other.
When
there
is
traffic
going
over
that
wire
now,
there's
the
element
of
identity.
Now
the
Z
tunnel
itself.
A
Now.
This
is
also
where
we
can
apply
our
layer,
4
authorization
policy.
So
if
you're
very
familiar
with
how
you
can
work
with
firewalls
I,
look
at
this
as
more
of
a
layer,
4
layer,
3
firewall,
because
now
I
could
just
go
ahead
and
say
I'm,
going
to
a
certain
set
of
workloads.
Have
this
label
we're
really
looking
at
it
at
a
TCP,
IP
layer?
We're
not
looking
at
it
at
any.
A
You
know
at
layer
seven,
so
we
can
Implement
a
kind
of
like
a
firewall
policy
to
say
this
service
can't
talk
to
that
service,
and
we
could
do
this
repeatedly
if
we
wanted
to
now.
How
does
Z
tunnel
actually
get
the
certificate,
so
Z10
will
actually
solicit
the
workloads
for
its
service
account
token,
once
it
gets
that
it
actually
goes
to
istiod
the
istio-d
control,
plane
and
says:
hey
I
am
I,
am
actually
a
z
tunnel
on
this
node
and
I'm,
trying
to
impersonate
or
I'm
trying
to
service
this
identity.
A
Now,
if
we
have
multiple
workloads
that
same
Z
tunnel
pod
is
going
to
service
all
of
these
different
workloads
that
exist
on.
Let's
say
that
node
and
this
you
know
you
might
wonder:
okay,
what
happens
when
we
have
many
many
kinds
of
workloads
running
well.
There
are
different
ways
to
scale
that
we're
investigating.
One
thing
I
will
point
out
is
steel.
A
Ambient
mesh
is
still
experimental,
it's
not
ready
for
production,
but
the
reason
I
say
that
is
because
we're
still
testing
we're,
still
scale
testing
we're
still
validating
various
kinds
of
use,
cases
that
we
can
achieve
with
with
ambient
mesh.
So
in
the
failure
scenario
here,
let's
say
that
this
z-tunnel
pod
went
down
what
would
happen
well.
Kubernetes
will
try
to
reconcile
that,
but
why
did
that
pod
go
down?
Did
the
node
go
down?
Did
the
node
get
disconnected
from
the
actual
Network?
A
A
Now,
in
the
situation
where
I
want
to
implement
layer,
7
authorization
policies,
I
have
to
deploy
a
waypoint
proxy,
like
I
mentioned
previous
previously,
before
what
that
means
is
I
have
to
deploy
a
a
Gateway
API
resource,
specifically
for
the
Waypoint
proxy
for
the
destination
workload
where
I'm
trying
to
communicate
towards
and
then
I'll
go
about.
Creating
my
layer,
7
authorization
policy
when
I
create
that
policy.
It
could
be.
A
So
maybe
you
need
to
be
thinking
about.
You
know
how
do
I
prevent
us
from
pulling
down
containers
that
we
shouldn't
be
pulling
down
and
deploying
into
our
environment
when
it
comes
to
when
it
comes
to
the
proxy
itself.
The
original
sidecar
proxy
has
so
many
different
ways
to
you
know
create
policy
ways
to
tune
it.
There
are
a
lot
of
different
observability
filters
that
you
can
tap
into,
and
this
is
great
for
the
sidecar
because
it
provides
all
of
that
functionality.
But
one
of
the
the
biggest
challenges
here
is.
A
These
are
all
the
different
points
of
attack
or
points
of
potential
vulnerability.
Now,
if
we
slim
down
that
proxy
to
just
doing
layer,
4
and
mtls,
then
we
can
remove
all
the
additional
features
and
we
can
just
secure
that
surface
area
significantly.
So
this
way
we
have
a
smaller
exposure
area
and
we
limit
ourselves
to
you,
know
the
attack
surface
altogether
and
then
there's
the
final
piece
of
node
compromise.
A
So
node
compromise
is
interesting
because
I
get
that
question
a
lot
all
right,
I
have
an
app
that's
going
to
be
talking
to
the
Z
tunnel
to
you
know
forward
requests
over
that
communication
between
let's
say
that
pod
and
that
z-tunnel
pod
is
not
encrypted.
Okay!
That's
great!
That's!
That's!
That's
wonderful!
But
here's!
The
other
thing!
Why
does
someone
have
access
to
your
node?
A
Why
do
they
have
root
access?
You
know
this.
Isn't?
This
is
more
of
a
physical
control
situation.
This
is
more
of
a
role-based
Access
Control
situation.
Do
you
have
those
proper
policies
in
place
to
prevent
people
from
being
able
to
even
get
into
your
node?
Are
you
using
secure
operating
systems
or
even
secure
distributions
to
run
your
clusters,
so
there
are
other
considerations
to
think
about
other
than
the
fact
that
app,
a
and
the
z-tunnel
don't
have
encrypted
Communications.
A
B
All
right,
thank
you,
Mourinho,
so
I
don't
know
about
you,
but
I'm,
someone
who
really
enjoys
not
just
hearing
about
how
things
work,
but
actually
seeing
how
they
work,
and
so
we're
going
to
we're
going
to
do
that
here
with
with
a
brief
demonstration
of
of
ambient
mesh
in
the
in
the
time
we
have
remaining,
and
so
we're
actually
going
to
start
from
the
from
the
basically
from
the
ground
up.
Okay,
we've
done
a
little
bit
of
pre-installation
here
you
can
see,
we
have
a.
B
We
have
a
kind
cluster
has
four
nodes
on
it:
there's
a
a
control
plane
node.
There
are
three
worker
nodes
that
are
that
are
active
here,
and
so
what
we've
done
is
we've.
We've
there's
actually
a
script
that
goes
along
with
this.
If
you're
interested
in
in
learning
more,
you
can
actually
follow
along
with
this
exercise
and
and
do
a
lot
more
than
just
what
we're
going
to
accomplish
here
in
the
next
10
or
15
minutes.
By
going
to
academy.solo.io.
Look
for
this
ambient
mesh
course
right
here.
B
It's
all
perfectly
free
and
you
can
actually
go
through
this
exercise
on
your
own
time
and
and
dive
into
it
a
little
more
deeply.
So
at
this
point
we
have
a.
We
have
a
four
node
cluster.
That's
here,
we've
deployed
that
and
we
have
also
we
have
also
deployed
istio
now
at
this
point
ambient
is
not
the
default
mode
for
istio
was,
as
Mourinho
said.
Ambient
is
still
is
still
experimental.
B
B
It
gives
us
an
Ingress
Gateway
and
also
the
cni
components
that
that
that
Mourinho
mentioned
that's
responsible
for
redirecting
traffic
between
the
the
worker,
the
workloads
and
the
and
the
Z
tunnels
that
actually
manage
the
layer,
4
policy
policy
enforcement
Okay.
So
we've
we've
done
that
we've
done
that
installation.
You
can
actually
see
the
the
pods
that
are
that
are
available
here.
So
here
are
the
here.
B
Are
the
istio
system
pods,
you
can
see,
there's
the
istioc
and
I
node
it's
deployed
as
a
Daemon
set,
so
you
can
see
we
have
one
per
node.
We
also
have
the
z-tunnel
components
that
have
been
deployed
as
well.
Now,
at
this
point,
they're
not
really
doing
anything,
because
we
haven't
activated
ambient
for
any
of
our
application
workspaces
but
they're
there
there's
one
deployed
per
node,
they're
ready
to
they're
ready
to
go,
and
you
can
also
see
we
have
deployed
some
workloads
that
we're
going
to
be
using
in
this
exercise.
B
B
Now
these
Services
aren't
really
real
we're
using
a
little
framework
called
the
fake
service
that
allows
us
to
just
basically
test
policy
enforcement
against
the
the
communication,
as
it
happens
across
across
the
different
service
boundaries
and
basically,
when
you
hit
each
service,
what
you're
going
to
get
back
is
just
a
kind
of
an
echo
message
that
says:
hey
you're
in
the
purchase
history
service
now
and
that
sort
of
thing.
So
that's
that's
our
that's
our
application
workload.
If
you
will,
we
also
have
a
couple
of
client
pods
that
we
have
deployed
here.
B
There's
one
called
sleep
and
one
called
not
sleep.
You'll
you'll
see
those
be
activated
in
just
a
bit.
Okay.
We
have
also
we're
also
using
just
standard
istio
apis
to
expose
these
workloads
to
the
outside
world
if
you're
familiar
with
istio,
there's
nothing,
there's
nothing
exotic
or
unusual
here
at
all
we're
just
using.
We
basically
have
a.
We
have
a
Gateway
component
that
we've
defined
that
just
says:
hey
we're
listening
in
on
the
host
istioexplain.io
on
Port
80
with
HTTP,
and
then
we're
also
establishing
a
virtual
service
to
Route
traffic.
B
That's
intended
for
that
domain
to
our
web
API
service,
which
is
kind
of
the
the
head
of
our
the
head
of
our
application
chain
that
we
are
using
here.
Okay,
so
once
we
have
once
we
have
all
of
that
in
place,
we
can
do
just
some
simple
tests
here.
So
this
is
one
we're
actually
going
to
go
through
the
through
the
Gateway
through
the
istio
Ingress
Gateway,
coming
from
outside
the
cluster.
B
It's
going
to
route
to
the
web
API
service,
which
is
in
turn
going
to
invoke
all
of
the
others
in
the
chain,
and
you
can
see
that
when
we,
when
we
call
that
here
there
is
our
web
API
response
and
you
can
see
it
makes
some
Upstream
calls.
One
of
those
is
the
recommendation
service.
The
recommendation
service
in
turn
makes
a
call
Upstream
to
the
to
the
purchase
history
service.
So
a
pretty
simple
setup.
Everything
is
working.
B
B
First
of
all,
we're
going
to
add
services
to
the
ambient
mesh
you're,
going
to
see
how
the
activation
takes
place,
we're
going
to
look
at
some
specific
layer,
4
authorization
policies,
just
basic
things
that
you
can
do
that
are
pro
that
are
applied
via
the
z-tunnel
component
and
then
finally,
we'll
show
you
just
a
really
quick
example
of
a
layer,
7
authorization
policy
as
well.
So,
let's,
let's
kick
off
this
this
exercise
and
the
first
thing
we
want
to
do
so.
B
We
have
the
ambient
profile
of
istio
installed,
but
we've
not
activated
it
for
any
of
our
namespaces.
Yet
so
what
we're
going
to
do?
We're
going
to
label
the
default
namespace,
which
is
where
our
web
API
purchase
history,
our
e-commerce
application
services
are
deployed,
and
so,
once
we
label
that
what's
going
to
happen,
is
we're
going
to
see
we're
going
to
see
ambient
mode
be
activated
for
the
services
in
this?
B
Okay,
so
the
nice
thing
is
we're
not
having
to
go
and
restart
those
components
at
all,
we're
not
having
to
inject
a
sidecar
or
anything
like
that.
But
you
can
see
here
for
our
application
pods
that
we
still
have
a
single.
You
know:
there's
no
sidecar
injected,
there's
there's!
No.
There
aren't
two
containers
that
are
active
within
those
within
those
pods
there's
only
a
single
one
and
in
fact
the
Z
tunnel
is
handling
the
the
routing
of
the
traffic
okay.
B
B
What
will
happen
is
the
traffic's
going
to
look
something
like
what's
depicted
in
that
diagram
that
it's
very
similar
to
what
Mourinho
showed,
where
we're
going
to
have
a
client
app
talking
to
its
local
Z
tunnel,
it's
going
to
establish
a
an
h-bone
tunnel
to
a
z
tunnel
on
the
target
machine,
and
then
it
will
Route
traffic
to
the
actual
Target
Services,
okay,
so
no
side
car
is
required.
So
if
we
generate
some
traffic
now
to
this
to
this
API
service,
you
can
actually
see
what
the
Z
tunnel
is
is
doing.
B
So,
if
we
take
a
look
at
the
at
the
Z
tunnel
logs,
you
can
see
here's
here's
the
the
HTTP
connect
tunnel.
That's
that's
being
established
here.
You
can
see
some
of
the
of
the
spiffy
IDs
that
indicate
things
like,
for
example,
we're
going
from
the
like
from
the
from
the
web
API
to
the
recommendation
engine.
You
can
also
see
here
at
the
very
bottom,
a
record
where
that
we're
capturing
outbound
traffic
and
there's
no
Waypoint
proxy.
B
That
is
that's
involved,
and
that's
because
all
we're
doing
here
is
we're
just
activating
the
layer,
4
component
of
the
network.
Right,
we're
encrypting
the
traffic
we're
using
we're
using
cryptographic
identities
to
establish
the
connection
between
between
the
Z
tunnels
and
the
and
the
source,
the
source
and
destination
services,
but
because
there's
no
layer,
seven
policy,
that's
being
applied,
we
don't
have
to.
We
don't
have
to
have
one
of
those
activated
at
this
point.
B
So
that's
an
important
consideration
for
a
lot
of
what
we
see:
customers
who
are
adopting
ambient
mesh
or
adopting
istio.
They
care
primarily
about
the
the
security
aspects
of
of
securing
the
services
within
their
mesh.
They
don't
necessarily
need
the
full
layer,
7
capabilities,
and
so
this
gives
you
a
way
to
incrementally
adopt
just
the
components
of
istio
that
you
need
without
biting
off
the
full,
the
full
layer
7
model.
B
Okay,
so
we
can
see
there's
traffic
now
going
through
the
through
the
Z
tunnel
and
now
let's
actually
apply
some
policies
to
that
to
that
traffic.
So,
first
we'll
start
with
you
know:
good
zero
trust
Foundation.
Here
we're
going
to
start
with
the
policy
that
basically
denies
all
denies
all
traffic
okay.
So
this
is
an
allow
nothing
authorization
policy.
Another
thing
you
might
notice
is
that
the
the
istio
apis
we're
using
standard
istio
apis
here
the
apis
themselves
have
not
changed.
It's
simply.
The
way
the
icod
control
plane
is
is
activating.
B
These
policies
is
by
programming.
You
know
Z
tunnels
and
Waypoint
proxies
as
opposed
to
programming
sidecars
that
are
attached
to
each
individual
workload.
So
once
we
establish
that
allow
nothing
authorization
policy
we'll
do
the
exact
same
operation
we
did
before
that
worked.
Fine,
and
not
surprisingly,
what's
going
to
happen
is
that
request
is
going
to
be
denied,
so
we
will
expand
out
our
authorization
policy
again
using
best
you
know,
least,
privileged
access
sort
of
practices
will
establish
a
suite
of
policies
that
basically
authorize
each
link
in
that
service
chain.
B
So
here
is
one
for
the
for
the
web
API
component.
It's
going
to
allow
it's
going
to
allow
requests
that
come
from
either
this
this
sleep
identity,
the
sleep
pod
or
from
the
istio
Ingress
Gateway
component,
all
right
so
and
then
in
turn
the
next
Link
in
the
chain.
The
recommendation
service
is
only
going
to
allow
access
from
the
web
API
identity
and,
finally,
the
third
link
in
the
chain.
B
The
purchase
history
component
is
only
going
to
allow
access
from
the
recommendation
service-
okay,
pretty
straightforward
stuff,
but
gives
you
a
nice
policy-based
Foundation
for
for
establishing
this
sort
of
thing
now
so
now?
What
do
we
expect
to
happen
if
we
use
that
same
that
same
invocation
again
in
this
case
now,
we
expect
that
it's
going
to
work
just
fine,
because
we've
authorized
each
link
in
the
in
the
service
chain
and
in
fact
that's
exactly
what
you
see
we're
hitting
web
API,
we're
hitting
recommendation
and
we're
hitting
purchase
history.
Okay,.
B
So
we've
talked
about.
We've
talked
about
the
layer,
four
policies,
how
those
are
applied
via
the
via
the
Z
tunnel.
We
can
also
apply
layer,
7
policies
for
services
for
identities,
where
that
makes
sense.
We
can
spin
up
the
additional
infrastructure
to
to
make
that
happen,
but
we
don't
have
to
buy
it
off
on
establishing
that
infrastructure
for
each
and
every
workload
in
the
mesh.
So
in
this
case,
what
we're
going
to
do
is
we're
going
to
establish
a
layer,
7
policy
for
this
web
API
identity,
okay
and
so
to
do
that.
B
We're
going
to
first
spin
up
a
waypoint
proxy,
which
is
at
this
point
just
a
it's
an
Envoy
proxy,
just
like
just
like
the
like
side,
cars
are
in
istio
that
that's
actually
going
to
be
the
policy
enforcement
point
for
for
this
policy.
So
all
right.
What
does
the
policy
look
like
we're
going
to
do?
Well,
first
of
all,
let's
actually,
as
Mourinho
said,
we're
going
to
use
the
game,
Gateway
API,
to
actually
spin
up
that
that
Waypoint
proxy.
So
you
can
see
this
Gateway.
This
Gateway
corresponds
to
the
web.
B
B
Here
we
go:
did
you
offer
your
sacrifice
to
the
demo
Gods
this
morning?
Mourinho
I
forgot,
that's
probably
what's
going
on
here
all
right,
so
so
all
right,
so
we
have.
We
have
established
that
Gateway
and
if
the
gods
are
being
kind
to
us,
we
can
look
now
and
we
should
see
that
a
a
waypoint
proxy
corresponding
to
this
web
API
service
has
indeed
been
been
spun
up
for
us
and
now,
let's
actually
do
something
interesting.
So
so
far,
we've
only
been
specifying
policies
that
require
layer,
4
access.
B
Let's
do
something
that
that
introduces
a
layer,
7
component,
an
HTTP
component,
so
we're
going
to
expand
out
the
web
API
policy
so
that
now
we're
using
we're
allowing
traffic
from
the
same
principles
as
before,
but
we're
only
supporting
HTTP
get
methods
all
right,
so
something
that
requires
layer,
7
access
to
to
be
able
to
enforce.
So
when
we,
when
we
activate
that
policy.
B
Now,
if
we
try
to
do
the
same
thing
that
we
did
before
this
is
going
to
work
because
we're
issuing
an
HTTP
get
against
the
against
the
web,
API
all
right,
and
so
that's
all.
That's
all
fine!
That
works,
but
if
we
try
to
issue
a
delete
request
instead
of
a
get
request,
what
do
you
expect
to
happen?
The
policy
is
going
to
kick
in
and
we're
going
to
get
an
access
denied
message
there.
You
can
also
see
we
get
back,
because
this
is
at
the
HTTP
level.
A
A
Now
what
this
means
is
because
we're
you
know
operating
with
less
sidecars.
That
means
there
are
less
resources
consumed,
but
does
that
mean
we
lose
any
capability?
No,
because
we've
shifted
that
operation
towards
the
Z
tunnel
and
the
Waypoint
proxy.
If
I
want
layer,
4
authorization,
it's
there
layer,
seven,
it's
also
there,
but
through
that
Gateway
API
deployed
Waypoint
proxy.
A
Finally,
I
wanted
to
just
point
out
one
very
interesting
thing
here.
You
might
have
noticed
that
the
Waypoint
proxy,
as
well
as
the
Z
tunnel,
currently
use
implementations
of
Envoy.
There
is
work
being
done
today
in
the
istio
community
to
change
that
that
z-tunnel
proxy
to
be
rust-based
so
that
it
could
be
far
more
performant.
It
could
also
allow
us
to
you
know
scale
in
different
ways
as
well,
so
you
could
go
check
that
out.
A
There's
actually,
if
I'm
not
mistaken,
the
istio
community
has
even
got
a
branch
for
that
that
you
can
go
check
out
and
even
test
it
out
for
yourself
to
understand
like
what
the
performance
might
look
like.
In
fact,
I
think
one
of
the
istio
contributors
also
created
a
very
good
document
that
just
walks
through
the
different
Envoy,
a
go-based
proxy
and
a
rust
based
proxy
and
the
different
performance
metrics
that
come
out
of
that
as
well.
A
Finally,
I
will
say
if
you
are,
if
you
are
interested
to
play
with
ambient
mesh
in
detail,
we
have
a
lab.
That's
available
through
solo
Academy.
Go
check
that
out.
It's
academy.solo.io.
We
have
ambient
Ambient
mesh
based
workshops.
We
also
have
istio.
We
have
ebpf
and
psyllium
so
that
you
can
learn
the
whole
stack
for
application
networking.
A
A
So
currently
as
it
stands,
you
can't
at
the
moment
only
because
there
hasn't
been
any
sort
of
I'd,
say
configuration
or
coding
or
programming,
for
let's
say
the
istioc
and
iPod
to
direct
that
directly
to
the
Waypoint
and
in
fact
the
Waypoint
is
only
meant
to
be
deployed.
When
you
have
to
you
know,
use
layers
of
an
authorization
most
of
the
are
all
of
the
traffic
should
be
flowing
through
the
Z
tunnel,
so
that
it
can
decide.
Do
we
want
to
Tunnel
towards
a
waypoint
or
directly
to
another
Z
tunnel,
so
that
we
can
maintain.
C
C
A
Well,
yeah,
there
could
be
other
options
specifically
for
istio
we've
gone
on
the
path
of
using
the
Z
tunnel
and
then
taking
advantage
of
the
h-bone
protocol.
That,
in
fact,
if
you
go
look
at
I,
think
istio
1.16
now
supports.
If
I'm
not
mistaken,
don't
quote
me
on
this,
because
I
got
to
go
back
and
check
now
supports
H
bone
to
the
sidecar
as
well.
So
this
means
that
there's
more
integration
going
towards
this
ambient
mesh
and
non-ambient
based
workloads
that
run
the
sidecar.