[virtualization][kubernetes_administration] Securing networks with Istio

[LukeShortCloud]

Basically, Istio is a more advanced and feature-rich take on the traditional NetworkPolicy.

Features:

• Zero-trust by default.
• Layer 7 security (vs. NetworkPolicy layer 4 security).
• Security handled in the Pod (vs NetworkPolicy which is in the kernel).

https://blog.aquasec.com/istio-kubernetes-security-zero-trust-networking

[LukeShortCloud]

Cons:

• Overhead of resource consumption (Istio adds a side-car container to EVERY Pod)
• Upgrades of Istio will likely require downtime as all side-car containers will have to be deleted and recreated with the new version (interrupting network traffic temporarily)

https://containerjournal.com/topics/container-management/dont-let-your-service-mesh-become-a-service-mess/