# istio-operator.yaml
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: istio-control-plane
  namespace: istio-system
spec:
  profile: default
  meshConfig:
    enableAutoMtls: true                    # 开启自动mTLS
    defaultConfig:
      proxyMetadata:
        ISTIO_META_DNS_CAPTURE: "true"
        ISTIO_META_DNS_AUTO_ALLOCATE: "true"
      tracing:
        sampling: 10                        # 采样率10%，视频流量建议低采样
      proxyResources:
        requests:
          cpu: "200m"
          memory: "256Mi"
        limits:
          cpu: "1000m"
          memory: "1Gi"
  components:
    pilot:
      k8s:
        hpaSpec:
          minReplicas: 3
          maxReplicas: 10
    ingressGateways:
      - name: istio-ingressgateway
        enabled: true
        k8s:
          resources:
            requests:
              cpu: "500m"
              memory: "512Mi"
          service:
            type: LoadBalancer
            ports:
              - port: 443
                targetPort: 8443
                name: https-tls
              - port: 3478
                targetPort: 3478
                name: turn-tls
                protocol: UDP

# peer-authentication-mtls.yaml
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: video-conference
spec:
  mtls:
    mode: STRICT                           # 拒绝明文流量
---
# 针对遗留服务的宽容模式例外
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: legacy-signaling-permissive
  namespace: video-conference
spec:
  selector:
    matchLabels:
      app: legacy-sip-gateway
  mtls:
    mode: PERMISSIVE                       # 临时兼容，设定迁移截止日期
  portLevelMtls:
    5060:
      mode: DISABLE                        # SIP明文端口显式关闭mTLS

# request-authentication-jwt.yaml
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: signaling-jwt-auth
  namespace: video-conference
spec:
  selector:
    matchLabels:
      app: signaling-server
  jwtRules:
    - issuer: "https://auth.corp.example.com"
      audiences:
        - "video-conference-api"
      jwksUri: "https://auth.corp.example.com/.well-known/jwks.json"
      forwardOriginalToken: true           # 透传原始Token给上游服务
      fromHeaders:
        - name: Authorization
          prefix: "Bearer "
      fromParams:
        - "access_token"                   # 支持WebSocket握手Query参数传Token

# 租户级JWT Claims校验（通过CEL表达式）
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: multi-tenant-jwt
  namespace: video-conference
spec:
  selector:
    matchLabels:
      app: conference-manager
  jwtRules:
    - issuer: "https://auth.corp.example.com"
      audiences:
        - "video-conference-api"
      jwksUri: "https://auth.corp.example.com/.well-known/jwks.json"
      outputClaimToHeaders:
        - header: "x-tenant-id"
          claim: "tenant_id"
        - header: "x-user-role"
          claim: "role"

# authorization-deny-all.yaml
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-all-baseline
  namespace: video-conference
spec:
  selector: {}                             # 选中命名空间所有工作负载
  action: DENY
  rules:
    - from:
        - source:
            notPrincipals: ["*"]           # 显式拒绝所有，后续ALLOW规则覆盖

# authorization-signaling.yaml
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: signaling-rbac
  namespace: video-conference
spec:
  selector:
    matchLabels:
      app: signaling-server
  action: ALLOW
  rules:
    # 1. 内部服务间调用（服务身份）
    - from:
        - source:
            principals:
              - "cluster.local/ns/video-conference/sa/media-proxy"
              - "cluster.local/ns/video-conference/sa/recording-service"
              - "cluster.local/ns/monitoring/sa/prometheus"
      to:
        - operation:
            methods: ["GET", "POST"]
            paths: ["/api/v1/calls/*", "/ws/*"]
    
    # 2. 终端用户访问（JWT Claims）
    - from:
        - source:
            requestPrincipals: ["*"]       # 任意合法JWT
      when:
        - key: request.auth.claims[role]
          values: ["host", "participant", "admin"]
      to:
        - operation:
            methods: ["GET", "POST"]
            paths: ["/api/v1/conferences/*", "/ws/*"]
    
    # 3. 管理员全量权限
    - from:
        - source:
            requestPrincipals: ["*"]
      when:
        - key: request.auth.claims[role]
          values: ["admin"]
      to:
        - operation:
            methods: ["*"]
            paths: ["/*"]

# authorization-media-plane.yaml
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: media-plane-trust
  namespace: video-conference
spec:
  selector:
    matchLabels:
      app: media-proxy
  action: ALLOW
  rules:
    - from:
        - source:
            principals:
              - "cluster.local/ns/video-conference/sa/signaling-server"
              - "cluster.local/ns/video-conference/sa/turn-server"
      to:
        - operation:
            ports: ["443", "3478", "49152-65535"]  # RTP端口范围
            methods: ["*"]

# destination-rule-media-proxy.yaml
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: media-proxy-dr
  namespace: video-conference
spec:
  host: media-proxy.video-conference.svc.cluster.local
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 10000              # 单Sidecar最大TCP连接数
      http:
        h2UpgradePolicy: UPGRADE
        http1MaxPendingRequests: 5000
        http2MaxRequests: 10000
        maxRequestsPerConnection: 100
    outlierDetection:
      consecutive5xxErrors: 3              # 连续3次5xx触发熔断
      interval: 10s                        # 检测间隔
      baseEjectionTime: 30s                # 最小驱逐时间
      maxEjectionPercent: 50               # 最大驱逐比例50%
      minHealthPercent: 30                 # 最小健康实例比例
    tls:
      mode: ISTIO_MUTUAL                   # 服务间mTLS

# envoy-filter-ratelimit.yaml (全局限流需配合RateLimitService)
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: signaling-ratelimit
  namespace: video-conference
spec:
  workloadSelector:
    labels:
      app: signaling-server
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_INBOUND
        listener:
          filterChain:
            filter:
              name: envoy.filters.network.http_connection_manager
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.local_ratelimit
          typed_config:
            "@type": type.googleapis.com/udpa.type.v1.TypedStruct
            type_url: type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
            value:
              stat_prefix: "signaling_ratelimit"
              token_bucket:
                max_tokens: 10000           # 突发令牌桶
                tokens_per_fill: 2000       # 每秒填充
                fill_interval: 1s
              filter_enabled:
                runtime_key: "ratelimit_enabled"
                default_value:
                  numerator: 100
                  denominator: HUNDRED
              filter_enforced:
                runtime_key: "ratelimit_enforced"
                default_value:
                  numerator: 100
                  denominator: HUNDRED
              response_headers_to_add:
                - header:
                    key: "x-ratelimit-limit"
                    value: "10000"
                - header:
                    key: "x-ratelimit-remaining"
                    value: "%REMAINING%"

# virtual-service-media-canary.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: media-proxy-canary
  namespace: video-conference
spec:
  hosts:
    - media-proxy.video-conference.svc.cluster.local
  http:
    - match:
        - headers:
            x-canary:
              exact: "true"
      route:
        - destination:
            host: media-proxy.video-conference.svc.cluster.local
            subset: v2-beta
          weight: 100
    - route:
        - destination:
            host: media-proxy.video-conference.svc.cluster.local
            subset: v1-stable
          weight: 90
        - destination:
            host: media-proxy.video-conference.svc.cluster.local
            subset: v2-beta
          weight: 10
      retries:
        attempts: 2
        perTryTimeout: 2s
        retryOn: "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes"
      timeout: 10s
---
# 对应DestinationRule子集定义
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: media-proxy-subsets
  namespace: video-conference
spec:
  host: media-proxy.video-conference.svc.cluster.local
  subsets:
    - name: v1-stable
      labels:
        version: v1.4.2
    - name: v2-beta
      labels:
        version: v2.0.0-rc.3

# serviceentry-turn.yaml
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: turn-server-external
  namespace: video-conference
spec:
  hosts:
    - turn.corp.example.com
  location: MESH_EXTERNAL
  ports:
    - number: 3478
      name: turn-tls
      protocol: TLS
    - number: 443
      name: turn-tls-alt
      protocol: TLS
  resolution: DNS
  workloadSelector:
    labels:
      app: turn-server
---
# WorkloadEntry（若TURN部署在VM/裸金属）
apiVersion: networking.istio.io/v1beta1
kind: WorkloadEntry
metadata:
  name: turn-vm-01
  namespace: video-conference
spec:
  address: 10.10.20.5
  labels:
    app: turn-server
    class: vm
  network: onprem-network
  serviceAccount: turn-server-sa

# telemetry-audit.yaml (Istio 1.18+ Telemetry API)
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: audit-logging
  namespace: video-conference
spec:
  selector:
    matchLabels:
      app: signaling-server
  accessLogging:
    - providers:
        - name: otel
      filter:
        expression: |
          request.auth.principal != "" && 
          (request.path.startsWith("/api/v1/conferences") || request.path.startsWith("/ws"))

# 1. Primary集群：生成Remote加入所需Secret (istioctl x create-remote-secret)
# 2. 在每个Remote集群应用Secret，建立信任锚
---
# 3. 统一Trust Domain与Root CA (生产环境建议对接外部CA: Vault/ cert-manager/ SPIRE)
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: istio-control-plane
  namespace: istio-system
spec:
  meshConfig:
    trustDomain: video-conference.corp  # 全网统一Trust Domain
    caCertificates:
      - pemCert: |
          -----BEGIN CERTIFICATE-----
          MIIF... (Root CA Cert)
          -----END CERTIFICATE-----
        pemKey: |
          -----BEGIN PRIVATE KEY-----
          MIIE... (Root CA Key - 仅Primary持有，Remote仅需Cert)
          -----END PRIVATE KEY-----
        rootCert: |
          -----BEGIN CERTIFICATE-----
          MIIF... (Root CA Cert)
          -----END CERTIFICATE-----
        certChain: |
          -----BEGIN CERTIFICATE-----
          MIIF... (Intermediate CA Cert)
          -----END CERTIFICATE-----

# authorization-cross-cluster.yaml
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: signaling-cross-cluster-rbac
  namespace: video-conference
spec:
  selector:
    matchLabels:
      app: signaling-server
  action: ALLOW
  rules:
    # 1. 同集群内部调用 (默认允许)
    - from:
        - source:
            principals:
              - "video-conference.corp/ns/video-conference/sa/media-proxy"
      to:
        - operation:
            hosts: ["signaling-server.video-conference.svc.cluster.local"]
    
    # 2. 跨集群媒体节点调用 (携带集群标签)
    - from:
        - source:
            principals:
              - "video-conference.corp/ns/video-conference/sa/media-proxy"
            namespaces: ["video-conference"]
            # 关键：通过source.labels匹配集群拓扑标签 (需Istio 1.18+ 支持)
            # 要求Remote集群Sidecar注入时注入 topology.istio.io/region 标签
      when:
        - key: source.labels[topology.istio.io/region]
          values: ["cn-east-1", "cn-south-1", "ap-singapore"]
      to:
        - operation:
            hosts: ["signaling-server.video-conference.svc.clusterset.local"]
            methods: ["POST"]
            paths: ["/api/v1/calls/*/allocate-media"]
    
    # 3. 拒绝非授权集群访问 (防御配置下发错误)
    - from:
        - source:
            notPrincipals: ["video-conference.corp/ns/video-conference/sa/*"]
      action: DENY

# virtual-service-media-locality.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: media-proxy-locality
  namespace: video-conference
spec:
  hosts:
    - media-proxy.video-conference.svc.clusterset.local  # 全局MCS服务名
  http:
    - match:
        - headers:
            x-user-region:  # 由Ingress Gateway根据GeoIP注入
              exact: "cn-east-1"
      route:
        - destination:
            host: media-proxy.video-conference.svc.clusterset.local
            subset: v1-stable
          weight: 100
      # 关键：Locality Load Balancing 配置 (在DestinationRule中生效)
---
# destination-rule-locality-lb.yaml
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: media-proxy-global-dr
  namespace: video-conference
spec:
  host: media-proxy.video-conference.svc.clusterset.local
  trafficPolicy:
    loadBalancer:
      localityLbSetting:
        enabled: true
        # 优先同Zone -> 同Region -> 跨Region
        distribute:
          - from: "region/cn-east-1/zone/*"
            to:
              "region/cn-east-1/zone/*": 80
              "region/cn-east-1/zone/*": 20  # 同Region其他Zone
              "region/*/*": 0                # 禁止跨Region
        failover:
          - from: "region/cn-east-1/zone/*"
            to: "region/cn-south-1/*"        # 仅当本Region全挂时故障转移
    outlierDetection:
      consecutive5xxErrors: 3
      interval: 5s
      baseEjectionTime: 30s
  subsets:
    - name: v1-stable
      labels:
        version: v1.4.2
      trafficPolicy:
        # 针对媒体节点的连接池调优
        connectionPool:
          tcp:
            maxConnections: 50000

// src/lib.rs - 核心逻辑骨架
use proxy_wasm::traits::*;
use proxy_wasm::types::*;
use serde::{Deserialize, Serialize};
use std::collections::HashMap;

#[derive(Deserialize, Serialize, Debug, Clone)]
struct PluginConfig {
    // 从Envoy配置下发的动态规则
    max_sdp_media_sections: usize,
    blocked_codecs: Vec<String>,           // 禁止的编解码器 (如 "H264/90000" 弱加密变体)
    max_ws_frame_size: usize,
    signaling_rate_limit: RateLimitConfig,
    pii_patterns: Vec<String>,             // 正则脱敏规则
}

#[derive(Deserialize, Serialize, Debug, Clone)]
struct RateLimitConfig {
    max_requests_per_second: u32,
    burst: u32,
    key_header: String,                    // 限流Key来源: "x-user-id" / "x-tenant-id"
}

proxy_wasm::main! {{
    proxy_wasm::set_log_level(LogLevel::Info);
    proxy_wasm::set_http_context(|_, _| -> Box<dyn HttpContext> { Box::new(SignalingFilter) });
    proxy_wasm::set_stream_context(|_, _| -> Box<dyn StreamContext> { Box::new(TcpSdpFilter) });
}}

// HTTP上下文：处理WebSocket升级握手及后续帧
struct SignalingFilter {
    config: PluginConfig,
    ws_state: WebSocketState,
    rate_limiter: TokenBucket,
}

impl HttpContext for SignalingFilter {
    fn on_http_request_headers(&mut self, _num_headers: usize, _end_of_stream: bool) -> Action {
        // 1. 识别WebSocket升级请求
        if self.is_websocket_upgrade() {
            self.ws_state = WebSocketState::Handshake;
            // 从JWT Claim或Header提取限流Key
            let key = self.get_header(self.config.signaling_rate_limit.key_header).unwrap_or_default();
            self.rate_limiter = TokenBucket::new(key, self.config.signaling_rate_limit);
        }
        Action::Continue
    }

    fn on_http_request_body(&mut self, body_size: usize, _end_of_stream: bool) -> Action {
        if self.ws_state == WebSocketState::DataFrame {
            // 2. 解析WebSocket帧 (RFC 6455)
            let frames = self.parse_websocket_frames(body_size);
            for frame in frames {
                // 3. 信令帧限流
                if frame.opcode == OpCode::Text || frame.opcode == OpCode::Binary {
                    if !self.rate_limiter.allow(1) {
                        self.send_local_reply(429, "Signaling Rate Limited", vec![], None);
                        return Action::Pause;
                    }
                    // 4. SDP载荷深度检测 (INVITE/SDP / Offer/Answer)
                    if self.contains_sdp(&frame.payload) {
                        if let Err(e) = self.validate_sdp(&frame.payload) {
                            log::warn!("SDP Validation Failed: {}", e);
                            self.send_local_reply(400, "Invalid SDP", vec![], None);
                            return Action::Pause;
                        }
                    }
                    // 5. PII脱敏 (仅审计日志，不修改转发给上游的帧)
                    self.audit_log_sanitized(&frame.payload);
                }
            }
        }
        Action::Continue
    }
}

// TCP上下文：处理纯TCP承载的SIP/SDP (如Interop网关)
struct TcpSdpFilter { config: PluginConfig }
impl StreamContext for TcpSdpFilter {
    fn on_downstream_data(&mut self, _size: usize, _eof: bool) -> Action {
        // 类似HTTP Body逻辑，直接解析TCP流中的SIP/SDP
        Action::Continue
    }
}

# wasm-plugin-signaling-guard.yaml
apiVersion: extensions.istio.io/v1alpha1
kind: WasmPlugin
metadata:
  name: signaling-security-guard
  namespace: istio-system
spec:
  url: oci://registry.corp.example.com/wasm/signaling-guard:v1.2.3
  sha256: "a1b2c3d4..."  # 镜像摘要，保证供应链安全
  pluginConfig:
    max_sdp_media_sections: 5
    blocked_codecs: ["H264/90000", "PCMU/8000"]  # 示例：禁用无加密音频
    max_ws_frame_size: 16384
    signaling_rate_limit:
      max_requests_per_second: 100
      burst: 200
      key_header: "x-user-id"
    pii_patterns:
      - "\b1[3-9]\d{9}\b"           # 手机号
      - "\b\d{17}[\dXx]\b"         # 身份证
---
# wasm-plugin-binding.yaml (绑定到特定工作负载)
apiVersion: extensions.istio.io/v1alpha1
kind: WasmPluginBinding
metadata:
  name: signaling-guard-binding
  namespace: video-conference
spec:
  workloadSelector:
    labels:
      app: signaling-server
  plugins:
    - name: signaling-security-guard
      phase: AUTHZ_BEFORE          # 在AuthorizationPolicy之前执行，可拦截恶意请求
      priority: 100
      failOpen: false              # 插件崩溃/超时时拒绝流量 (零信任强一致性)

# deployment-signaling-with-qos.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: signaling-server
  namespace: video-conference
spec:
  template:
    spec:
      containers:
        - name: app
          resources:
            requests:
              cpu: "500m"
              memory: "1Gi"
            limits:
              cpu: "2000m"
              memory: "4Gi"
        - name: istio-proxy
          resources:
            requests:
              cpu: "300m"          # 保障基础转发能力
              memory: "512Mi"
            limits:
              cpu: "2000m"         # 允许突发抢占，应对流量洪峰
              memory: "2Gi"
          env:
            # 关键性能调优参数
            - name: ISTIO_META_CPU_LIMIT
              value: "2000m"
            - name: ISTIO_META_WORKLOAD_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            - name: PILOT_ENABLE_EDS_DEBOUNCE
              value: "true"        # 减少EDS推送抖动
            - name: PILOT_ENABLE_CONFIG_DISTRIBUTION_TRACKING
              value: "false"       # 关闭配置分发追踪，降低CPU
            - name: ENVOY_CONCURRENCY
              value: "4"           # 绑定CPU核心数，避免线程迁移

# daemonset-sysctl-tuning.yaml
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: node-network-tuning
  namespace: kube-system
spec:
  template:
    spec:
      initContainers:
        - name: sysctl
          image: busybox:1.36
          securityContext:
            privileged: true
            runAsUser: 0
          command:
            - /bin/sh
            - -c
            - |
              # TCP优化 (信令/控制面)
              sysctl -w net.core.somaxconn=65535
              sysctl -w net.core.netdev_max_backlog=65535
              sysctl -w net.ipv4.tcp_max_syn_backlog=65535
              sysctl -w net.ipv4.tcp_fastopen=3
              sysctl -w net.ipv4.tcp_slow_start_after_idle=0
              sysctl -w net.ipv4.tcp_notsent_lowat=16384
              
              # UDP优化 (媒体面 RTP/RTCP)
              sysctl -w net.core.rmem_max=16777216
              sysctl -w net.core.wmem_max=16777216
              sysctl -w net.core.rmem_default=262144
              sysctl -w net.core.wmem_default=262144
              sysctl -w net.ipv4.udp_mem="262144 524288 1048576"
              sysctl -w net.ipv4.udp_rmem_min=131072
              sysctl -w net.ipv4.udp_wmem_min=131072
              
              # 连接追踪优化 (大规模长连接)
              sysctl -w net.netfilter.nf_conntrack_max=2000000
              sysctl -w net.netfilter.nf_conntrack_tcp_timeout_established=86400
              sysctl -w net.netfilter.nf_conntrack_udp_timeout=30
              sysctl -w net.netfilter.nf_conntrack_udp_timeout_stream=180
              
              # BBR拥塞控制 (需内核5.10+)
              sysctl -w net.core.default_qdisc=fq
              sysctl -w net.ipv4.tcp_congestion_control=bbr

# envoy-filter-performance.yaml
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: envoy-perf-tuning
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      app: media-proxy
  configPatches:
    # 1. 监听器优化：启用REUSEPORT、多队列、零拷贝发送
    - applyTo: LISTENER
      match:
        listener:
          filterChain:
            filter:
              name: envoy.filters.network.tcp_proxy
      patch:
        operation: MERGE
        value:
          enable_reuse_port: true
          listener_filters:
            - name: envoy.listener.tls_inspector
              typed_config:
                "@type": type.googleapis.com/envoy.extensions.listener.tls_inspector.v3.TlsInspector
          socket_options:
            - description: "SO_RXQ_OVFL"
              level: 1
              name: 40
              state: STATE_PREBIND
              value: 1
            - description: "TCP_ZEROCOPY_TRANSFER" (Linux 5.14+)
              level: 6
              name: 58
              state: STATE_PREBIND
              value: 1
    
    # 2. 集群上游连接池优化：HTTP/2 多路复用、连接预热
    - applyTo: CLUSTER
      match:
        cluster:
          service: "media-proxy.video-conference.svc.cluster.local"
      patch:
        operation: MERGE
        value:
          http2_protocol_options:
            max_concurrent_streams: 10000
            initial_stream_window_size: 65535
            initial_connection_window_size: 1048576
          upstream_connection_options:
            tcp_keepalive:
              keepalive_time: 30
              keepalive_interval: 10
              keepalive_probes: 3
          # 连接预热：启动时建立连接，避免首包延迟
          warmup_policy:
            warmup_interval: 5s
            min_warmup_connections: 100
    
    # 3. 线程模型：主线程+Worker线程隔离，减少锁竞争
    - applyTo: BOOTSTRAP
      patch:
        operation: MERGE
        value:
          concurrency: 4
          # 关键：将监听器绑定到特定Worker (需Envoy 1.26+)
          # 通过 listener_filter 配置实现，此处略

# cilium-config.yaml (ConfigMap)
apiVersion: v1
kind: ConfigMap
metadata:
  name: cilium-config
  namespace: kube-system
data:
  enable-ipv4: "true"
  enable-ipv6: "false"
  tunnel: "vxlan"              # 或 geneve
  enable-l7-proxy: "true"      # 保留L7代理处理信令
  enable-xdp: "true"           # 启用XDP加速
  xdp-mode: "native"           # native/driver/generic
  enable-bandwidth-manager: "true"
  bpf-lb-algorithm: "maglev"   # 一致性哈希，会话亲和
  # 关键：排除媒体端口不走L7 Proxy
  proxy-exclude-port-range: "30000-65535"  # RTP端口范围
---
# CiliumNetworkPolicy 实现媒体面微隔离 (替代AuthorizationPolicy for UDP)
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: media-plane-xdp-policy
  namespace: video-conference
spec:
  endpointSelector:
    matchLabels:
      app: media-proxy
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: signaling-server
      toPorts:
        - ports:
            - port: "30000-65535"
              protocol: UDP
          rules:
            udp:
              - sourcePort: 3478  # TURN

istio-config/
├── base/                          # 通用基础配置 (CRD、PeerAuthn默认、Telemetry默认)
│   ├── peer-authentication.yaml
│   ├── telemetry.yaml
│   └── kustomization.yaml
├── components/                    # 可复用组件库
│   ├── mtls-strict/
│   ├── jwt-auth/
│   ├── ratelimit-local/
│   ├── wasm-plugins/
│   └── kustomization.yaml
├── overlays/                      # 环境差异化覆盖
│   ├── dev/
│   │   ├── kustomization.yaml
│   │   ├── peer-authentication.yaml  # PERMISSIVE
│   │   └── replica-count.yaml
│   ├── staging/
│   │   ├── kustomization.yaml
│   │   └── canary-weight.yaml
│   └── prod/
│       ├── kustomization.yaml
│       ├── peer-authentication.yaml  # STRICT
│       ├── hpa-aggressive.yaml
│       └── wasm-plugin-binding.yaml
├── clusters/                      # 多集群差异化 (Primary/Remote)
│   ├── primary/
│   │   ├── service-export.yaml
│   │   └── root-ca-secret.yaml
│   ├── remote-cn-east/
│   │   ├── service-import.yaml
│   │   └── locality-gateway.yaml
│   └── remote-cn-south/
└── apps/                          # 业务应用专属策略 (由应用团队维护 PR)
    ├── signaling/
    │   ├── authorization-policy.yaml
    │   ├── virtual-service.yaml
    │   └── destination-rule.yaml
    ├── media-proxy/
    └── recording/

# .github/workflows/istio-policy-ci.yaml
name: Istio Policy CI
on: [pull_request]
jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Install istioctl
        run: curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.22.0 sh - && echo "$HOME/istio-1.22.0/bin" >> $GITHUB_PATH
      
      - name: Syntax & Semantic Check (istioctl analyze)
        run: |
          # 合并所有 overlay 模拟目标环境
          kustomize build overlays/prod > /tmp/manifest.yaml
          istioctl analyze -f /tmp/manifest.yaml --use-kube=false --all-namespaces
      
      - name: OPA Policy Unit Tests (Rego)
        run: |
          # 测试 AuthorizationPolicy 是否符合最小权限原则
          opa test policies/ -v
      
      - name: Kind Integration Test
        uses: helm/kind-action@v1.8.0
        with:
          cluster_name: istio-test
          install_local_path_provisioner: true
      
      - name: Deploy Istio & Test Workloads
        run: |
          istioctl install -f manifests/istio-minimal.yaml -y
          kubectl apply -f /tmp/manifest.yaml
          # 部署模拟客户端/服务端 Pod
          kubectl run curl-pod --image=curlimages/curl:8.7.1 -- sleep 3600
          # 执行连通性/授权/限流测试脚本
          ./tests/run_e2e.sh
      
      - name: Performance Baseline Check (可选)
        run: |
          # 使用 fortio/hey 对比基准性能，防止配置变更引入回归
          ./tests/perf_compare.sh

# policies/authorization.rego
package istio.authorization

# 禁止 DEFAULT ALLOW 规则
deny[msg] {
    input.kind == "AuthorizationPolicy"
    input.spec.action == "ALLOW"
    not input.spec.rules[_].from
    msg := sprintf("AuthorizationPolicy %s/%s: ALLOW rule must have 'from' condition (Zero Trust)", [input.metadata.namespace, input.metadata.name])
}

# 禁止宽泛的 Principal 通配符
deny[msg] {
    input.kind == "AuthorizationPolicy"
    rule := input.spec.rules[_]
    from := rule.from[_]
    source := from.source
    source.principals[_] == "*"
    msg := sprintf("AuthorizationPolicy %s/%s: Principal '*' is too permissive", [input.metadata.namespace, input.metadata.name])
}

# 强制 JWT 保护的服务必须有 RequestAuthentication
deny[msg] {
    input.kind == "AuthorizationPolicy"
    rule := input.spec.rules[_]
    when := rule.when[_]
    when.key == "request.auth.claims[role]"
    not exists_ra(input.metadata.namespace, input.spec.selector.matchLabels.app)
    msg := sprintf("Service %s uses JWT claims but missing RequestAuthentication", [input.spec.selector.matchLabels.app])
}

exists_ra(ns, app) {
    ra := data.k8s.requestauthentications[ns][_]
    ra.spec.selector.matchLabels.app == app
}

# rollout-signaling.yaml
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: signaling-server
  namespace: video-conference
spec:
  replicas: 10
  strategy:
    canary:
      canaryMetadata:
        labels:
          version: canary
      stableMetadata:
        labels:
          version: stable
      steps:
        - setWeight: 5
        - pause: {duration: 10m}
        - analysis:
            templates:
              - templateName: signaling-slo-check
        - setWeight: 20
        - pause: {duration: 15m}
        - analysis:
            templates:
              - templateName: signaling-slo-check
        - setWeight: 50
        - pause: {duration: 30m}
        - setWeight: 100
      trafficRouting:
        istio:
          virtualService:
            name: signaling-server-vsvc
          destinationRule:
            name: signaling-server-dr
  selector:
    matchLabels:
      app: signaling-server
  template:
    metadata:
      labels:
        app: signaling-server
        version: stable
    spec:
      containers:
        - name: app
          image: registry.corp.example.com/signaling:v2.1.0
---
# analysis-template-slo.yaml
apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: signaling-slo-check
  namespace: video-conference
spec:
  metrics:
    - name: error-rate
      interval: 1m
      successCondition: result[0] < 0.001
      failureLimit: 3
      provider:
        prometheus:
          address: http://prometheus.monitoring.svc:9090
          query: |
            sum(rate(istio_requests_total{reporter="source",destination_service=~"signaling-server.*",response_code=~"5.."}[2m])) 
            / 
            sum(rate(istio_requests_total{reporter="source",destination_service=~"signaling-server.*"}[2m]))
    - name: p99-latency
      interval: 1m
      successCondition: result[0] < 200
      provider:
        prometheus:
          query: |
            histogram_quantile(0.99, sum(rate(istio_request_duration_milliseconds_bucket{destination_service=~"signaling-server.*"}[2m])) by (le))
    - name: mtls-success-rate
      successCondition: result[0] > 0.999
      provider:
        prometheus:
          query: |
            sum(rate(istio_tls_handshakes_total{result="success"}[5m])) / sum(rate(istio_tls_handshakes_total[5m]))

# 1. 启用 Ambient (安装时或升级)
# istioctl install --set values.pilot.env.PILOT_ENABLE_AMBIENT_CONTROLLERS=true 
#   --set values.ztunnel.enabled=true --set values.cni.enabled=true

# 2. 命名空间加入 Ambient (逐个迁移)
apiVersion: v1
kind: Namespace
metadata:
  name: video-conference
  labels:
    istio.io/dataplane-mode: ambient  # 关键标签
---
# 3. WayPoint 代理：替代 Sidecar 处理 L7 策略 (信令面必需)
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: signaling-waypoint
  namespace: video-conference
spec:
  gatewayClassName: istio-waypoint
  listeners:
    - name: https
      port: 443
      protocol: HTTPS
      tls:
        mode: Terminate
        certificateRefs:
          - kind: Secret
            name: signaling-tls-cert
---
# WayPoint 部署配置 (HPA、资源、副本)
apiVersion: gateway.networking.k8s.io/v1alpha2
kind: Waypoint
metadata:
  name: signaling-waypoint
  namespace: video-conference
spec:
  replicas: 6
  resources:
    requests:
      cpu: "500m"
      memory: "1Gi"
    limits:
      cpu: "2000m"
      memory: "4Gi"
---
# 4. L4 AuthorizationPolicy (Ztunnel 层面生效，无需 WayPoint)
# 保护媒体节点 UDP/TCP 端口，零 Sidecar 开销
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: media-plane-l4-authz
  namespace: video-conference
spec:
  selector:
    matchLabels:
      app: media-proxy
  action: ALLOW
  rules:
    - to:
        - operation:
            ports: ["30000-65535", "3478"]
            protocols: ["UDP", "TCP"]
      from:
        - source:
            principals:
              - "video-conference.corp/ns/video-conference/sa/signaling-server"
              - "video-conference.corp/ns/video-conference/sa/turn-server"
---
# 5. L7 AuthorizationPolicy (WayPoint 层面生效)
# 复用现有 JWT/HTTP 策略，无需修改语法
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: signaling-l7-authz
  namespace: video-conference
spec:
  selector:
    matchLabels:
      app: signaling-server
  action: ALLOW
  rules:
    - from:
        - source:
            requestPrincipals: ["*"]
      when:
        - key: request.auth.claims[role]
          values: ["host", "participant"]
      to:
        - operation:
            methods: ["GET", "POST"]
            paths: ["/api/v1/conferences/*", "/ws/*"]

# 识别模式
kubectl get pods -n video-conference -o custom-columns=NAME:.metadata.name,MODE:.metadata.labels.'istio.io/dataplane-mode',SIDECAR:.spec.containers[*].name

# 网络策略互通验证
# Sidecar -> Ambient: mTLS 正常 (PeerAuthentication STRICT 生效)
# Ambient -> Sidecar: mTLS 正常 (Ztunnel 发起握手)
# 关键检查: istioctl x authz check <pod> --destination <svc> 在两种模式下输出一致

graph LR
    A[外部 Root CA<br/>Vault/小步/商用CA] -->|签发 Intermediate CA| B(Istio CA / cert-manager)
    B -->|CSR 自动轮转<br/>TTL 4-8h| C[Workload Cert<br/>SPIFFE ID]
    C -->|监控过期/吊销| D[Cert-Manager / CSI Driver]
    D -->|事件触发| E[告警/自动滚动重启]
    F[安全事件<br/>密钥泄露/人员离职] -->|API 调用| G[Vault Revoke / CRL/OCSP]
    G -->|推送吊销列表| B
    B -->|拒绝握手| H[Envoy/Ztunnel]

# 示例：基于 Prometheus Alertmanager Webhook 触发 Istio 策略动态下发
# alertmanager-config.yaml
receivers:
  - name: istio-auto-remediation
    webhook_configs:
      - url: http://soar-adapter.istio-system:8080/webhook
        http_config:
          bearer_token_file: /etc/alertmanager/token
---
# soar-adapter 处理逻辑 (伪代码)
func handleAlert(alert Alert) {
    if alert.Labels["type"] == "authz_anomaly" && alert.Labels["severity"] == "critical" {
        // 1. 提取异常源身份
        srcPrincipal := alert.Labels["source_principal"]
        dstService := alert.Labels["destination_service"]
        
        // 2. 生成紧急拒绝策略 (TTL 1小时 自动过期)
        emergencyPolicy := AuthorizationPolicy{
            Name: fmt.Sprintf("emergency-block-%s-%d", srcPrincipal, time.Now().Unix()),
            Namespace: alert.Labels["namespace"],
            Spec: AuthorizationPolicySpec{
                Action: DENY,
                Rules: []Rule{
                    {From: []Source{{Source: &Source{Principals: []string{srcPrincipal}}}}},
                },
            },
            Annotations: map[string]string{
                "auto-generated": "true",
                "ttl": "1h",
                "alert-id": alert.Fingerprint,
            },
        }
        // 3. Apply 到集群 (需 RBAC 权限)
        k8sClient.Apply(emergencyPolicy)
        
        // 4. 记录审计、通知值班
        auditLog.Record("AUTO_REMEDIATION", emergencyPolicy)
        pagerduty.Notify(alert)
    }
}

#!/bin/bash
# generate_audit_evidence.sh (每日定时任务/CI 制品)

OUT_DIR="audit-evidence/$(date +%Y%m%d)"
mkdir -p $OUT_DIR

# 1. 当前生效的安全策略快照
istioctl analyze -n video-conference -o json > $OUT_DIR/istio-analyze.json
kubectl get peerauthentication,requestauthentication,authorizationpolicy,wasmplugin,wasmpluginbinding -n video-conference -o yaml > $OUT_DIR/security-policies.yaml

# 2. 证书状态报告
istioctl x authz check --namespace video-conference > $OUT_DIR/mtls-status.txt
kubectl get secret -n istio-system -l istio.io/ca-root=true -o yaml > $OUT_DIR/ca-cert-chain.yaml

# 3. 审计日志完整性校验 (假设日志存 Loki/ES)
logcli query --since=24h '{namespace="video-conference", container="istio-proxy"} | json | select(.request.auth.principal != "")' --output=jsonl > $OUT_DIR/audit-logs.jsonl
sha256sum $OUT_DIR/audit-logs.jsonl > $OUT_DIR/audit-logs.sha256

# 4. 网络拓扑与微隔离验证报告
istioctl describe pod -n video-conference -o json > $OUT_DIR/pod-config.json
# 生成服务调用图
istioctl dashboard grafana &  # 导出 Dashboard JSON 作为证据

# 5. 打包签名
tar -czf $OUT_DIR.tar.gz $OUT_DIR
cosign sign-blob $OUT_DIR.tar.gz --key env://COSIGN_PRIVATE_KEY

mindmap
  root((视频会议零信任架构))
    身份信任基石
      SPIFFE ID
      mTLS STRICT
      外部CA/短周期轮转
      多集群联邦信任
    纵深鉴权体系
      L4: AuthorizationPolicy(Principal/Label)
      L7: JWT + Claim RBAC/ABAC
      协议感知: WASM(SDP/WS/SIP)
      动态响应: SOAR自动下发
    流量治理与质量保障
      熔断/限流/重试/超时
      就近路由/Locality LB
      金丝雀/蓝绿/自动回滚
      UDP媒体面: XDP/eBPF旁路
    工程化交付体系
      GitOps(Kustomize/ArgoCD)
      策略即代码/OPA测试
      渐进式交付/Argo Rollouts
      Ambient Mesh演进
    可观测与合规闭环
      四大黄金信号+业务指标
      审计日志脱敏/归档/签名
      证据链自动化生成