graph TB
    Client[客户端/网关] -->|mTLS + JWT| IngressGW[Ingress Gateway]
    IngressGW -->|Sidecar 代理| AuthZ[AuthorizationPolicy]
    AuthZ -->|RBAC 校验| Signaling[信令服务]
    AuthZ -->|流量策略| Media[媒体服务器]
    Signaling -.->|mTLS| Media
    Media -.->|mTLS| Recording[录制/转码]

# peer-authentication-strict.yaml
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: video-conf
spec:
  mtls:
    mode: STRICT   # 禁止明文，Sidecar 自动协商证书

# request-authentication.yaml
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: jwt-validation
  namespace: video-conf
spec:
  selector:
    matchLabels:
      app: signaling-gateway   # 仅网关层校验，下游无感
  jwtRules:
  - issuer: "https://idp.example.com/realms/corp"
    jwksUri: "https://idp.example.com/realms/corp/protocol/openid-connect/certs"
    audiences:
    - "video-conf-api"
    forwardOriginalToken: true   # 透传给下游做业务级鉴权

# authz-deny-all.yaml
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-all-default
  namespace: video-conf
spec:
  selector: {}   # 选中命名空间内所有工作负载
  action: DENY
  rules: []      # 空规则 = 拒绝所有

# authz-signaling.yaml
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: signaling-allow
  namespace: video-conf
spec:
  selector:
    matchLabels:
      app: signaling
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/video-conf/sa/signaling-gateway"]
    to:
    - operation:
        methods: ["POST", "GET"]
        paths: ["/api/v1/rooms/*/join", "/api/v1/rooms/*/leave"]
    when:
    - key: request.auth.claims[roles]
      values: ["participant", "host", "admin"]

# authz-media.yaml
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: media-allow
  namespace: video-conf
spec:
  selector:
    matchLabels:
      app: media-server
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/video-conf/sa/signaling"]
    to:
    - operation:
        methods: ["POST"]
        paths: ["/allocate", "/release"]
    when:
    - key: request.headers[x-tenant-id]
      values: ["t_001", "t_002"]   # 仅放行已授权租户

# destination-rule-media.yaml
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: media-server-dr
  namespace: video-conf
spec:
  host: media-server
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 5000
      http:
        h2UpgradePolicy: UPGRADE
        http1MaxPendingRequests: 2000
        http2MaxRequests: 3000
    loadBalancer:
      simple: LEAST_REQUEST   # 优先分发给空闲节点
    outlierDetection:         # 熔断
      consecutive5xxErrors: 3
      interval: 10s
      baseEjectionTime: 30s
      maxEjectionPercent: 50

# envoyfilter-ratelimit.yaml
apiVersion: networking.istio.io/v1beta1
kind: EnvoyFilter
metadata:
  name: signaling-ratelimit
  namespace: video-conf
spec:
  workloadSelector:
    labels:
      app: signaling-gateway
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.filters.http.local_ratelimit
        typed_config:
          "@type": type.googleapis.com/udpa.type.v1.TypedStruct
          type_url: type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
          value:
            stat_prefix: http_local_rate_limiter
            token_bucket:
              max_tokens: 200          # 突发允许 200 RPS
              tokens_per_fill: 50      # 平滑 50 RPS
              fill_interval: 1s
            filter_enabled:
              runtime_key: local_rate_limit_enabled
              default_value:
                numerator: 100
                denominator: HUNDRED

# fault-injection-media.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: media-fault-drill
  namespace: video-conf
spec:
  hosts: ["media-server"]
  http:
  - match:
    - headers:
        x-chaos-drill:
          exact: "true"
    fault:
      delay:
        percentage:
          value: 10.0
        fixedDelay: 5s
      abort:
        percentage:
          value: 5.0
        httpStatus: 503
  - route:
    - destination:
        host: media-server

- alert: VideoConfAuthFailureSpike
  expr: increase(istio_requests_total{response_code=~"401|403",namespace="video-conf"}[5m]) > 50
  for: 2m
  labels:
    severity: warning
  annotations:
    summary: "视频会议鉴权失败激增，疑似凭证泄露或攻击"

graph LR
    Client[客户端] -->|UDP/STUN/TURN| GW[Media Gateway<br/>coturn/mediasoup]
    GW -->|Sidecar mTLS| Media[Media Server<br/>SFU/MCU]
    GW -.->|AuthorizationPolicy| AuthZ[Istio AuthZ]
    Media -.->|PeerAuthentication STRICT| GW

# dr-media-gateway-to-server.yaml
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: media-server-tls
  namespace: video-conf
spec:
  host: media-server.video-conf.svc.cluster.local
  trafficPolicy:
    tls:
      mode: ISTIO_MUTUAL   # 复用网格证书，无需额外 CA
    connectionPool:
      udp:                 # 针对媒体网关->服务器的 UDP 连接池
        maxConnections: 10000
    loadBalancer:
      simple: LEAST_REQUEST

# deployment-media-gateway.yaml (片段)
annotations:
  traffic.sidecar.istio.io/includeInboundPorts: "3478,49152-65535"  # TURN + RTP 范围
  traffic.sidecar.istio.io/excludeOutboundPorts: ""                 # 不排除任何出站
spec:
  template:
    spec:
      containers:
      - name: coturn
        ports:
        - containerPort: 3478
          protocol: UDP
        - containerPort: 49152
          protocol: UDP
        # ... 资源限制见第 13 节

# mesh-config-trust-domain.yaml (Primary 集群)
apiVersion: v1
kind: ConfigMap
metadata:
  name: istio
  namespace: istio-system
data:
  mesh: |
    trustDomain: video-conf.corp
    trustDomainAliases:
      - "video-conf.cn-shanghai"   # Remote 集群别名
      - "video-conf.sg"
      - "video-conf.eu-fr"

# istiooperator-remote.yaml
spec:
  values:
    global:
      meshID: mesh-video-conf
      multiCluster:
        clusterName: cn-shanghai
      network: network-cn-shanghai
      remotePilotAddress: 10.0.0.10  # Primary Pilot LB IP
      tls:
        # 使用共享根证书或插件证书 (建议对接 Vault/External CA)
        caAddress: "istiod.istio-system.svc:15012"

# vs-media-locality.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: media-server-global
  namespace: video-conf
spec:
  hosts: ["media-server"]
  http:
  - route:
    - destination:
        host: media-server
        subset: v1
      weight: 100
    # 故障转移：本地不可用 -> 就近 Region -> 兜底全球
    failover:
      - from: network-cn-shanghai
        to: network-cn-beijing
      - from: network-sg
        to: network-hk
    # 局部性加权 (需 Sidecar 启用 `PILOT_ENABLE_LOCALITY_LOAD_BALANCING=true`)
    localityLbSetting:
      enabled: true
      failover:
        - from: network-cn-shanghai
          to: network-cn-beijing
      distribute:
        - from: network-cn-shanghai
          to:
            network-cn-shanghai: 80
            network-cn-beijing: 20

# sidecar-tuning-env.yaml
env:
- name: PILOT_ENABLE_PROTOCOL_SNIFFING_FOR_INBOUND
  value: "false"          # 关闭协议嗅探，省 CPU，媒体流走 UDP 无需 HTTP 解析
- name: PILOT_ENABLE_PROTOCOL_SNIFFING_FOR_OUTBOUND
  value: "false"
- name: ISTIO_META_DNS_CAPTURE
  value: "false"          # 媒体节点通常不需 DNS 拦截
- name: ISTIO_META_DNS_AUTO_ALLOCATE
  value: "false"
- name: ENVOY_CONCURRENCY
  value: "2"              # 绑定 2 核处理网络中断，避免单核瓶颈
- name: ISTIO_CPU_LIMIT
  value: "2000m"          # 告知 Envoy 实际可用 CPU，优化线程池
- name: GOMAXPROCS
  value: "2"              # Go 运行时线程数

# sidecar-minimal.yaml
apiVersion: networking.istio.io/v1beta1
kind: Sidecar
metadata:
  name: media-server-sidecar
  namespace: video-conf
spec:
  workloadSelector:
    labels:
      app: media-server
  ingress:
  - port:
      number: 443
      protocol: HTTPS
      name: https-signaling
    defaultEndpoint: 127.0.0.1:8443   # 应用监听本地回环
  - port:
      number: 50000
      protocol: UDP
      name: udp-media
    defaultEndpoint: 127.0.0.1:50000
  egress:
  - hosts:
    - "./*"          # 仅允许访问同命名空间服务 (如配置中心、监控)
    - "istio-system/*"  # 允许访问 Pilot/Citadel

# .gitlab-ci.yml (片段)
stages:
  - validate
  - security-scan
  - deploy-canary

istio-lint:
  stage: validate
  image: istio/istioctl:1.22
  script:
    - istioctl analyze -k -f manifests/ --all-namespaces --use-kube=false
    # 严格模式：将 WARNING 视为 ERROR
    - istioctl analyze -f manifests/ --failure-threshold Warning
  allow_failure: false

opa-policy-check:
  stage: security-scan
  image: openpolicyagent/conftest:latest
  script:
    - conftest test manifests/ --policy policies/
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

package istio.security

deny[msg] {
  input.kind == "PeerAuthentication"
  input.spec.mtls.mode == "PERMISSIVE"
  not input.metadata.annotations["security.istio.io/temporary-permissive"]
  msg := sprintf("Namespace %s: PERMISSIVE mTLS forbidden without temporary annotation", [input.metadata.namespace])
}

deny[msg] {
  input.kind == "AuthorizationPolicy"
  not input.spec.rules
  not input.spec.action == "DENY"
  msg := "AuthorizationPolicy must have explicit rules or be explicit DENY"
}

# 构建阶段签名
cosign sign --key env://COSIGN_PRIVATE_KEY 
  registry.corp/video-conf/media-server:v1.2.3 
  --annotation "sbom=./sbom.spdx.json" 
  --annotation "built-by=gitlab-ci"

# kyverno-verify-image.yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-image-signature
spec:
  validationFailureAction: Enforce
  rules:
  - name: check-cosign-signature
    match:
      any:
      - resources:
          kinds: ["Pod"]
          namespaces: ["video-conf", "video-conf-prod"]
    verifyImages:
    - image: "registry.corp/video-conf/*"
      key: |-
        -----BEGIN PUBLIC KEY-----
        ...
        -----END PUBLIC KEY-----
      annotations:
        built-by: "gitlab-ci"

apiVersion: chaos-mesh.org/v1alpha1
kind: PodChaos
metadata:
  name: media-gateway-kill
  namespace: video-conf
spec:
  action: pod-failure
  mode: one
  duration: "30s"
  selector:
    labelSelectors:
      app: media-gateway
  scheduler:
    cron: "@once"
---
apiVersion: chaos-mesh.org/v1alpha1
kind: NetworkChaos
metadata:
  name: cert-rotation-latency
  namespace: istio-system
spec:
  action: delay
  mode: one
  delay:
    latency: "500ms"
    correlation: "25"
    jitter: "100ms"
  direction: both
  target:
    selector:
      labelSelectors:
        app: istiod
    mode: one
  duration: "2m"
  scheduler:
    cron: "@once"

import jwt, requests, time

# 1. 算法混淆攻击
payload = {"sub": "attacker", "roles": ["admin"], "exp": time.time()+3600}
# 尝试 none 算法
token_none = jwt.encode(payload, "", algorithm="none")
# 尝试 HS256 用公钥当密钥 (需获取公钥)
# ...

for token in [token_none, token_hs256]:
    r = requests.post("https://conf.corp/api/join", 
                      headers={"Authorization": f"Bearer {token}"},
                      json={"room_id": "target_room"})
    assert r.status_code == 401, f"BYPASS SUCCESS: {token[:20]}..."
print("All JWT confusion attacks blocked.")

# 1. 部署新版本 Istiod (Canary)
istioctl install --set profile=default --set revision=1-22-0 -y

# 2. 灰度命名空间 (先灰度非核心 NS)
kubectl label namespace video-conf-staging istio.io/rev=1-22-0 --overwrite
# 观察 24h：指标、日志、告警无异常

# 3. 核心命名空间分批切换 (按可用区/机房)
for ns in video-conf-sh video-conf-bj video-conf-sg; do
  kubectl label namespace $ns istio.io/rev=1-22-0 --overwrite
  sleep 300  # 观察 5 分钟
  # 关键检查：istioctl proxy-status | grep $ns | grep -v SYNCED
done

# 4. 卸载旧版本
istioctl uninstall --revision=1-20-0 --purge -y

# pdb-istio-proxy.yaml
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: media-server-pdb
  namespace: video-conf
spec:
  minAvailable: 80%   # 升级时至少保留 80% 副本
  selector:
    matchLabels:
      app: media-server

data:
  mesh: |
    defaultConfig:
      proxyMetadata:
        ISTIO_META_DNS_CAPTURE: "false"
        ISTIO_META_DNS_AUTO_ALLOCATE: "false"
        ENVoy_CONCURRENCY: "2"
      tracing:
        sampling: 1.0          # 全链路采样 (媒体流建议 0.1 降低开销)
      proxyStatsMatcher:
        inclusionRegexps:
        - ".*circuit_breaker.*"
        - ".*upstream_rq_retry.*"
        - ".*tls.*"
    enableAutoMtls: true
    trustDomain: video-conf.corp
    caCertificates:
    - pem: |
        -----BEGIN CERTIFICATE-----
        (Root CA Cert)
        -----END CERTIFICATE-----
      isRoot: true

# 1. 验证某 Pod mTLS 模式
istioctl x authz check <pod-name>.<ns> --destination <svc>.<ns>.svc.cluster.local

# 2. 查看 Sidecar 推送的 Listener/Route/Cluster/Endpoint (调试 503/404)
istioctl proxy-config all <pod>.<ns> -o json | jq '.[] | select(.name | contains("media"))'

# 3. 实时抓取 Sidecar 访问日志 (含 JWT Claim)
kubectl logs -f <pod> -c istio-proxy -n video-conf | jq 'select(.requestHeaders.authorization != null)'

# 4. 检查证书有效期 & SAN
istioctl pc secret <pod>.<ns> -o json | jq '.dynamicActiveSecrets[].secret.tlsCertificate.certificateChain.inlineBytes' | base64 -d | openssl x509 -text -noout

# 5. 验证 AuthorizationPolicy 生效情况 (干运行模式)
istioctl x authz check <pod>.<ns> --destination <svc>.<ns> --source <src-pod>.<src-ns> --dry-run