Yuval Kohavi

@soloio_inc

[Yuval Kohavi @KohaviYuval]

Happy Valentine's! have some fun with ext-auth and agentgateway https://t.co/e8b5rUzxXa

[Yuval Kohavi @KohaviYuval]

Makes sense, Every home has Windows

[Istio @IstioMesh]

We are proud to announce that Istio is migrating to Windows! Join us at Istio Day London, starting in 10 minutes to hear more!
https://t.co/QFabaYUP91
#kubecon #servicemesh

[solo.io @soloio_inc]

7 years. Hundreds of customers. Thousands of open-source users. From day 1, Gloo Gateway was built to be the most mature Envoy-based API gateway. Now, it’s part of CNCF as kgateway! 🚀 What did we learn? A 🧵 from @linsun_unc & @KohaviYuval ⬇️

[Yuval Kohavi @KohaviYuval]

@cgaunerd @Tesla Activate sentry mode

[Yuval Kohavi @KohaviYuval]

@christianposta mTLS for all workloads, without restarting anything, in under 5 minutes? is this magic??

[Keith Mattix @keithmattix]

I’m obviously biased, but I can’t wait for the moment when the industry at large really “gets” what Ambient mesh can do. It’s a literal game changer for cloud networking that does a great job at balancing complexity, cost and robustness. More here: https://t.co/TUBfV6EIBu

[Istio @IstioMesh]

Istio 1.23 is out! 🎉🎉🎉⛵️⛵️⛵️
Lots of improvement for ambient mode with 50% improvement in thoroughput compared to 1.22, along with a bunch of other improvements. Check it out 👇👇👇

https://t.co/cmWXvkPDaA

[howardjohn @_howardjohn]

Excited to share some of the work we have done to make Gloo the best way to run a service mesh! This one is a game changer IMO.
https://t.co/5zpGQ2669o

[Yuval Kohavi @KohaviYuval]

pods are overrated

[Istio @IstioMesh]

Istio without sidecar - YES;
Istio without pod? 🤔🤔🤔

Checkout @_howardjohn’s latest blog on his fun exploration:

https://t.co/nkaNR0MbsR

[howardjohn @_howardjohn]

Istio ambient is often seen as just "service mesh without sidecars". It is that, but it also solves a ton of pain points in Istio.

One of many things you won't need to worry about: securing all Prometheus scraping: https://t.co/fbLlH98ZeZ.

With ambient, it just works.

[solo.io @soloio_inc]

The upcoming @IstioMesh release brings an exciting feature called in-pod redirection mode, allowing #Istio Ambient Mesh to collaborate with any CNI. Check out @pjausovec's discussion with @KohaviYuval in this live stream recap. Learn more! #AmbientMesh
https://t.co/ccuFPlv72M

[Peter Jausovec @pjausovec]

🚨🚨 Ambient mesh with CNI
📅 January 23rd, 10:00am PST, 1:00pm EST

@KohaviYuval will talk about the in-pod redirection mode feature that just got merged into @IstioMesh !

Join to learn how this works and what it enables!

🙋‍♂️Who's coming?

Link ⏬⏬

[Lin Sun @linsun_unc]

[Just Blogged with @KohaviYuval] Secure Application Communications with Mutual TLS and @IstioMesh - Dive into securing application communications, mTLS and Istio to achieve end-to-end mTLS among your applications.

https://t.co/uyZKQr6VmV

[Stefan Prodan @stefanprodan]

New https://t.co/EfLCYqabr4 release 🚀 v0.13 comes with:
- Bundle Runtime - a declarative API for fetching values from #Kubernetes clusters.
- Module signing and verification with @projectsigstore.
- Enforce k8s min version for modules.
- Support for @cue_lang required fields.

[Yuval Kohavi @KohaviYuval]

@shakedko @Idit_Levine If the developer creates the pod, sidecar injection can be disabled. A worse example is if "hostNetwork: true" is set. This avoids both istio and the CNI.

All that to say, one should set policies to prevent devs from abusing the cluster - k8s is not a PaaS.

[Yuval Kohavi @KohaviYuval]

@shakedko @Idit_Levine An unprivileged pod can't normally escape Istio.
Most CNIs use policies that are based on the kubernetes NetworkPolicy. Istio's policies are workload or identity based. You can use both for defence in depth.

[Yuval Kohavi @KohaviYuval]

@shakedko @Idit_Levine Istio doesn't deal with low-level linux routing.

It assigns an identity to traffic leaving the pod, and encrypts it. It also handles application protocols like HTTP, providing observability and policy.

[Yuval Kohavi @KohaviYuval]

@stefanprodan at @soloio_inc we release betas that use the same release CI workflows
another approach (I think istio does this) is to split the release to 2 jobs: build and publish. where publish is trivial (just copy files around and push images). so if build fails nothing is published

[Yuval Kohavi @KohaviYuval]

Good read!

[howardjohn @_howardjohn]

Istio Ambient is not a "Node Proxy" - addressing some common misconceptions in Istio's ambient architecture.

https://t.co/JCRkAQkE0b