使用 Istio 缓解电信 5G IoT 微服务 Pod 架构的安全挑战

apiVersion: maistra.io/v2
kind: ServiceMeshControlPlane
metadata:
  name: full-install
  namespace: istio-system
spec:
  version: v2.1
  techPreview:
      meshConfig:
        defaultConfig:
          concurrency: 8     # Adjust according to the need
  proxy:
    runtime:
      container:
        resources:
          requests:
            cpu: 500m
            memory: 256Mi
          limits:             # Adjust according to the need
            cpu: "1"
            memory: 1Gi
  tracing:
    sampling: 10000 # 0.01% increments. 10000 samples 100% of traces
    type: Jaeger
  gateways:
    ingress: # istio-ingressgateway
      service:
        type: ClusterIP
        ports:
          - name: status-port
            port: 15020
          - name: http2
            port: 80
            targetPort: 8080
          - name: https
            port: 443
            targetPort: 8443
      meshExpansionPorts: []
    egress: # istio-egressgateway
      service:
        type: ClusterIP
        ports:
          - name: status-port
            port: 15020
          - name: http2
            port: 80
            targetPort: 8080
          - name: https
            port: 443
            targetPort: 8443
    additionalIngress:
      some-other-ingress-gateway: {}
    additionalEgress:
      some-other-egress-gateway: {}

  policy:
    type: Istiod
  telemetry:
    type: Istiod

  addons:
    grafana:
      enabled: true
    kiali:
      name: kiali
      enabled: true
      install: # install kiali CR if not available
        dashboard:
          viewOnly: false
          enableGrafana: true
          enableTracing: true
          enablePrometheus: true
    jaeger:
      name: jaeger-production
      install:
        storage:
          type: Elasticsearch
          elasticsearch:
            nodeCount: 3
            redundancyPolicy: SingleRedundancy
            indexCleaner:
              enabled: true
              numberOfDays: 7
              schedule: 55 23 * * *
        ingress:
          enabled: true
  runtime:
    components:
      tracing.jaeger.elasticsearch: # only supports resources and image name
        container:
          resources:
            limits:
              cpu: 1
              memory: 1Gi
            requests:
              cpu: 500m
              memory: 1Gi
      pilot:
        deployment:
          autoScaling:
            enabled: true
            minReplicas: 2
            maxReplicas: 2
            targetCPUUtilizationPercentage: 85
        pod:
          tolerations:
            - key: node.kubernetes.io/unreachable
              operator: Exists
              effect: NoExecute
              tolerationSeconds: 60
          affinity:
            podAntiAffinity:
              requiredDuringScheduling:
                - key: istio
                  topologyKey: kubernetes.io/hostname
                  operator: In
                  values:
                    - pilot
        container:
          resources:
            limits:                # Adjust according to the need
              cpu: "1"
              memory: 1Gi

apiVersion: maistra.io/v1
kind: ServiceMeshMemberRoll
metadata:
  name: default
  namespace: istio-system
spec:
  members:
  - <Micro services pods namespace>  #  namespace that needs be istio injected.