┌─────────────────────────────────────────────────────────────┐
│                      Istio Control Plane                      │
│  ┌──────────┐  ┌──────────┐  ┌──────────┐  ┌──────────┐     │
│  │ Pilot    │  │ Citadel  │  │ Galley   │  │ Mixer    │     │
│  │ (xDS)    │  │ (CA)     │  │ (配置校验)│  │ (策略/遥测)│     │
│  └──────────┘  └──────────┘  └──────────┘  └──────────┘     │
└─────────────────────────────────────────────────────────────┘
                              │ xDS
        ┌─────────────────────┼─────────────────────┐
        ▼                     ▼                     ▼
┌───────────────┐    ┌───────────────┐    ┌───────────────┐
│ 信令服务       │    │ 媒体转发服务   │    │ 会议管理服务   │
│ + Envoy Sidecar│    │ + Envoy Sidecar│    │ + Envoy Sidecar│
└───────────────┘    └───────────────┘    └───────────────┘

# namespace.yaml
apiVersion: v1
kind: Namespace
metadata:
  name: video-conference
  labels:
    istio-injection: enabled          # 开启自动Sidecar注入
    security.istio.io/tls-mode: istio # 启用严格mTLS
---
apiVersion: v1
kind: Namespace
metadata:
  name: video-conference-gateway
  labels:
    istio-injection: enabled

# peer-authentication-strict.yaml
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: video-conference
spec:
  mtls:
    mode: STRICT

spiffe://cluster.local/ns/video-conference/sa/signaling-service
spiffe://cluster.local/ns/video-conference/sa/media-relay-service

# authorizationpolicy-deny-all.yaml
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-all-baseline
  namespace: video-conference
spec:
  selector: {}  # 选中命名空间内所有工作负载
  action: DENY
  rules:
  - from:
    - source:
        notPrincipals: ["*"]  # 空规则配合 DENY 实现默认拒绝

# authorizationpolicy-signaling.yaml
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: signaling-service-authz
  namespace: video-conference
spec:
  selector:
    matchLabels:
      app: signaling-service
  action: ALLOW
  rules:
  # 1. 网关入站流量（携带 JWT）
  - from:
    - source:
        principals: ["spiffe://cluster.local/ns/video-conference-gateway/sa/istio-ingressgateway"]
    to:
    - operation:
        methods: ["GET", "POST"]
        paths: ["/api/v1/conferences/*", "/api/v1/participants/*"]
  # 2. 会议管理服务调用信令
  - from:
    - source:
        principals: ["spiffe://cluster.local/ns/video-conference/sa/conference-manager"]
    to:
    - operation:
        methods: ["POST"]
        paths: ["/internal/signaling/*"]
  # 3. 录制服务回调
  - from:
    - source:
        principals: ["spiffe://cluster.local/ns/video-conference/sa/recording-service"]
    to:
    - operation:
        methods: ["POST"]
        paths: ["/internal/callbacks/recording"]

# requestauthentication-jwt.yaml
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: jwt-validation
  namespace: video-conference-gateway
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  jwtRules:
  - issuer: "https://auth.company.com"
    audiences:
    - "video-conference-api"
    jwksUri: "https://auth.company.com/.well-known/jwks.json"
    forwardOriginalToken: true  # 透传原始 Token 给下游服务

# authorizationpolicy-gateway-jwt.yaml
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: gateway-jwt-required
  namespace: video-conference-gateway
spec:
  selector:
    matchLabels:
      istio: ingressgateway
  action: ALLOW
  rules:
  - from:
    - source:
        requestPrincipals: ["*"]  # 要求必须携带有效 JWT

# virtualservice-signaling.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: signaling-service
  namespace: video-conference
spec:
  hosts:
  - signaling-service
  http:
  # WebSocket 信令长连接：禁用超时，禁止重试
  - match:
    - uri:
        prefix: "/ws"
    route:
    - destination:
        host: signaling-service
    timeout: 0s          # 长连接不设超时
    retries:
      attempts: 0        # WebSocket 不重试
  # REST API：严格超时与有限重试
  - match:
    - uri:
        prefix: "/api"
    route:
    - destination:
        host: signaling-service
    timeout: 3s
    retries:
      attempts: 2
      perTryTimeout: 1s
      retryOn: "connect-failure,refused-stream,unavailable,cancelled,retriable-status-codes"
      retryRemoteLocalities: true

# destinationrule-media-relay.yaml
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: media-relay-service
  namespace: video-conference
spec:
  host: media-relay-service
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 10000
      http:
        h2UpgradePolicy: UPGRADE
        http1MaxPendingRequests: 5000
        http2MaxRequests: 10000
        maxRequestsPerConnection: 100
    outlierDetection:
      consecutive5xxErrors: 3
      interval: 10s
      baseEjectionTime: 30s
      maxEjectionPercent: 50
      minHealthPercent: 30

# envoyfilter-ratelimit.yaml
apiVersion: networking.istio.io/v1beta1
kind: EnvoyFilter
metadata:
  name: conference-create-ratelimit
  namespace: video-conference
spec:
  workloadSelector:
    labels:
      app: conference-manager
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.filters.http.local_ratelimit
        typed_config:
          "@type": type.googleapis.com/udpa.type.v1.TypedStruct
          type_url: type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
          value:
            stat_prefix: "conference_create_ratelimit"
            token_bucket:
              max_tokens: 100
              tokens_per_fill: 100
              fill_interval: 60s
            filter_enabled:
              runtime_key: "conference_create_enabled"
              default_value:
                numerator: 100
                denominator: HUNDRED
            filter_enforced:
              runtime_key: "conference_create_enforced"
              default_value:
                numerator: 100
                denominator: HUNDRED
            response_headers_to_add:
            - append: false
              header:
                key: "x-ratelimit-limit"
                value: "100"
            - append: false
              header:
                key: "x-ratelimit-remaining"
                value: "99"

# virtualservice-conference-ratelimit.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: conference-manager-ratelimit
  namespace: video-conference
spec:
  hosts:
  - conference-manager
  http:
  - match:
    - uri:
        exact: "/api/v1/conferences"
      headers:
        x-ratelimit-limit:
          exact: "100"
    route:
    - destination:
        host: conference-manager
    # 限流触发时返回 429
    fault:
      abort:
        httpStatus: 429
        percentage:
          value: 100

# virtualservice-media-canary.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: media-relay-canary
  namespace: video-conference
spec:
  hosts:
  - media-relay-service
  http:
  - route:
    - destination:
        host: media-relay-service
        subset: v1
      weight: 90
    - destination:
        host: media-relay-service
        subset: v2
      weight: 10
    mirror:
      host: media-relay-service
      subset: v2
    mirrorPercentage:
      value: 100  # 100% 镜像流量到 v2，不影响生产响应

# destinationrule-media-subsets.yaml
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: media-relay-service
  namespace: video-conference
spec:
  host: media-relay-service
  subsets:
  - name: v1
    labels:
      version: v1.2.0
  - name: v2
    labels:
      version: v2.0.0-rc1

# telemetry-accesslog.yaml
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: access-logging
  namespace: video-conference
spec:
  selector: {}
  accessLogging:
  - providers:
    - name: envoy
    disabled: false

{
  "start_time": "2024-01-15T10:30:00.123Z",
  "method": "POST",
  "path": "/api/v1/conferences",
  "protocol": "HTTP/2",
  "response_code": 201,
  "response_flags": "-",
  "bytes_received": 1024,
  "bytes_sent": 2048,
  "duration_ms": 45,
  "upstream_service_time": "32",
  "x_forwarded_for": "203.0.113.10",
  "user_agent": "VideoConfClient/2.1.0",
  "request_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "source_principal": "spiffe://cluster.local/ns/video-conference-gateway/sa/istio-ingressgateway",
  "destination_principal": "spiffe://cluster.local/ns/video-conference/sa/conference-manager",
  "authorization_policy": "conference-manager-authz",
  "tls_cipher": "TLS_AES_256_GCM_SHA384",
  "tls_version": "TLSv1.3"
}

# sidecar-resource-profile.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: sidecar-resource-profiles
  namespace: istio-system
data:
  # 媒体转发服务：高并发、长连接、大吞吐 -> 高 CPU、大内存、Guaranteed QoS
  media-relay-profile: |
    resources:
      requests:
        cpu: "500m"
        memory: "512Mi"
      limits:
        cpu: "2000m"
        memory: "2Gi"
    proxyMetadata:
      ISTIO_META_DNS_CAPTURE: "true"
      ISTIO_META_DNS_AUTO_ALLOCATE: "true"
  
  # 信令/管理服务：短连接、高 QPS、低延迟 -> 中等 CPU、小内存、Burstable QoS
  signaling-profile: |
    resources:
      requests:
        cpu: "100m"
        memory: "128Mi"
      limits:
        cpu: "1000m"
        memory: "512Mi"

# deployment-media-relay.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: media-relay-service
  namespace: video-conference
spec:
  template:
    metadata:
      annotations:
        sidecar.istio.io/proxyResources: '{"requests":{"cpu":"500m","memory":"512Mi"},"limits":{"cpu":"2000m","memory":"2Gi"}}'
        # 关键优化：绕过 iptables DNAT 开销，需内核 4.18+ / CNI 支持
        traffic.sidecar.istio.io/excludeInboundPorts: "50000-60000"  # 媒体端口范围直通
        traffic.sidecar.istio.io/includeOutboundIPRanges: "10.244.0.0/16" # 仅拦截集群内流量

# destinationrule-protocol-optimization.yaml
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: media-relay-protocol
  namespace: video-conference
spec:
  host: media-relay-service
  trafficPolicy:
    connectionPool:
      http:
        h2UpgradePolicy: UPGRADE          # 强制尝试 h2c 明文升级（集群内 mTLS 加密下安全）
        http2MaxRequests: 10000           # 单连接最大请求数，减少连接建立开销
        maxRequestsPerConnection: 100     # 避免头部阻塞
        http1MaxPendingRequests: 1000
        http2MaxFrames: 10000000          # 媒体信令大帧支持
    tls:
      mode: ISTIO_MUTUAL
      # 关键：启用 TLS 1.3 0-RTT 降低握手延迟（需 Istio 1.18+ / Envoy 1.26+）
      tlsProtocolVersion: "TLSv1_3"
      cipherSuites:
      - TLS_AES_256_GCM_SHA384
      - TLS_CHACHA20_POLY1305_SHA256

# 连接追踪表扩容（高并发长连接必改）
net.netfilter.nf_conntrack_max = 1048576
net.netfilter.nf_conntrack_tcp_timeout_established = 600
net.netfilter.nf_conntrack_tcp_timeout_time_wait = 30

# TCP 栈优化
net.core.somaxconn = 65535
net.ipv4.tcp_max_syn_backlog = 8192
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 15

┌─────────────────────────────────────────────────────────────────┐
│                    Primary Cluster (北京核心)                     │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────┐              │
│  │ Istiod      │  │ EastWest GW │  │ Config Sync │              │
│  │ (Primary)   │◄─┤ (网络互联)  │  │ (GitOps)    │              │
│  └─────────────┘  └─────────────┘  └─────────────┘              │
└─────────────────────────────────────────────────────────────────┘
         │                    │                    │
    ┌────┴────┐          ┌────┴────┐          ┌────┴────┐
    ▼         ▼          ▼         ▼          ▼         ▼
┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐
│ 上海边缘│ │ 广州边缘│ │ 新加坡边缘│ │ IDC 混合云│ │ 专线接入 │ │ 5G 边缘 │
│ Remote │ │ Remote │ │ Remote │ │ Remote │ │ Remote │ │ Remote │
└────────┘ └────────┘ └────────┘ └────────┘ └────────┘ └────────┘

# 1. Primary 生成根证书
istioctl install --set profile=default --set values.global.meshID=mesh1 --set values.global.multiCluster.clusterName=primary-beijing

# 2. 导出根证书分发
kubectl get secret cacerts -n istio-system -o yaml > cacerts.yaml
# 在每个 Remote 集群应用相同 cacerts.yaml

# 由 istioctl x cluster register 自动生成，核心配置如下：
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: eastwest-gateway
  namespace: istio-system
spec:
  selector:
    istio: eastwestgateway
  servers:
  - port:
      number: 15443
      name: tls
      protocol: TLS
    tls:
      mode: ISTIO_MUTUAL
    hosts:
    - "*.local"  # 仅暴露集群内服务
---
# 远程集群服务自动导入 (需开启 Pilot 环境变量 PILOT_ENABLE_CROSS_CLUSTER_WORKLOAD_ENTRY=true)
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: media-relay-shanghai
  namespace: video-conference
spec:
  hosts:
  - media-relay-service.video-conference.svc.cluster.local
  location: MESH_INTERNAL
  ports:
  - number: 443
    name: grpc
    protocol: GRPC
  resolution: DNS
  endpoints:
  - address: eastwest-gateway.shanghai.cluster.local  # 远程网关 VIP
    ports:
      grpc: 15443
  workloadSelector:
    labels:
      cluster: shanghai-edge

# virtualservice-cross-cluster-failover.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: media-relay-global
  namespace: video-conference
spec:
  hosts:
  - media-relay-service
  http:
  # 1. 就近路由：基于 Locality 感知负载均衡
  - route:
    - destination:
        host: media-relay-service
        subset: v1
      weight: 100
    # 关键：启用 locality 感知，优先同区域
    # 需在 DestinationRule 配置 outlierDetection 和 localityLbSetting
  
  # 2. 主动健康检查 + 被动熔断双重保障
  # 3. 故障切换：当本地集群实例全熔断，自动路由到远程集群
  # 实现方式：DestinationRule 设置 outlierDetection + localityLbSetting.failover

trafficPolicy:
  loadBalancer:
    localityLbSetting:
      enabled: true
      failover:
        - from: cn-beijing
          to: cn-shanghai
        - from: cn-shanghai
          to: cn-guangzhou
  outlierDetection:
    consecutive5xxErrors: 3
    interval: 5s
    baseEjectionTime: 30s

# constrainttemplate-istio-mtls-strict.yaml
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: istiomtlsstrict
spec:
  crd:
    spec:
      names:
        kind: IstioMTLSStrict
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package istio.mtls.strict
        violation[{"msg": msg}] {
          ns := input.review.object.metadata.namespace
          # 排除系统命名空间
          not system_ns(ns)
          # 检查 PeerAuthentication 是否存在且为 STRICT
          pa := data.k8s.peerauthentications["security.istio.io/v1beta1"][_]
          pa.metadata.namespace == ns
          pa.spec.mtls.mode != "STRICT"
          msg := sprintf("Namespace %s: PeerAuthentication must be STRICT mode", [ns])
        }
        system_ns(ns) {
          ns := {"kube-system", "istio-system", "monitoring", "logging"}
        }
---
# 实例化约束
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: IstioMTLSStrict
metadata:
  name: enforce-mtls-strict-all-ns
spec:
  match:
    kinds:
    - apiGroups: [""]
      kinds: ["Namespace"]

# CI/CD 流水线集成：istioctl analyze + 自定义规则
# .gitlab-ci.yml / Jenkinsfile 片段
stages:
  - validate
  - audit

istio_analyze:
  stage: validate
  script:
    - istioctl analyze -n video-conference --use-kube=false -f manifests/
    - |
      # 自定义规则检查：禁止通配符 Principal
      if grep -r "principal: "*"" manifests/security/; then
        echo "ERROR: Wildcard principal detected"
        exit 1
      fi

policy_audit:
  stage: audit
  script:
    - |
      # 导出所有 AuthorizationPolicy 转为 Rego 策略进行语义分析
      kubectl get authorizationpolicy -A -o json | 
      opa eval -i - -d policies/rbac.rego "data.istio.audit.violations" --format json

# envoyfilter-tag-sensitive.yaml
apiVersion: networking.istio.io/v1beta1
kind: EnvoyFilter
metadata:
  name: tag-sensitive-api
  namespace: video-conference
spec:
  workloadSelector:
    labels:
      app: conference-manager
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.filters.http.lua
        typed_config:
          "@type": type.googleapis.com/udpa.type.v1.TypedStruct
          type_url: type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
          value:
            inline_code: |
              function envoy_on_request(request_handle)
                local path = request_handle:headers():get(":path")
                if string.match(path, "/api/v1/recordings") or 
                   string.match(path, "/api/v1/transcripts") then
                  request_handle:headers():add("x-data-classification", "level-3-sensitive")
                  request_handle:logInfo("Sensitive API accessed: " .. path)
                end
              end

# fluent-bit-parser.conf
[PARSER]
    Name        istio_access
    Format      regex
    Regex       ^{"start_time":"(?<start_time>[^"]+)","method":"(?<method>[^"]+)","path":"(?<path>[^"]+)","response_code":(?<code>d+),"bytes_received":(?<rx>d+),"bytes_sent":(?<tx>d+),"duration_ms":(?<latency>d+),"source_principal":"(?<src_principal>[^"]+)","destination_principal":"(?<dst_principal>[^"]+)","authorization_policy":"(?<authz_policy>[^"]+)","tls_cipher":"(?<tls_cipher>[^"]+)","tls_version":"(?<tls_version>[^"]+).*
    Time_Key    start_time
    Time_Format %Y-%m-%dT%H:%M:%S.%LZ

[FILTER]
    Name                record_modifier
    Match               istio.*
    # 脱敏：移除/哈希化敏感字段
    Remove_keys         x-forwarded-for,cookie,authorization
    # 关键：记录数据分级标签
    Record              compliance_tag ${record["x-data-classification"]}
    Record              src_ns ${record["source_principal"] | split("/") | .[3]}
    Record              dst_ns ${record["destination_principal"] | split("/") | .[3]}

-- ClickHouse 合规查询示例
SELECT 
    toDate(start_time) as log_date,
    src_ns as source_namespace,
    dst_ns as dest_namespace,
    compliance_tag,
    count() as request_count,
    quantile(0.99)(latency) as p99_latency_ms,
    countIf(code >= 400) as error_count
FROM istio_access_logs
WHERE log_date >= yesterday()
GROUP BY log_date, source_namespace, dest_namespace, compliance_tag
ORDER BY log_date DESC, request_count DESC

# chaos-mtls-cert-rotation.yaml
apiVersion: chaos-mesh.org/v1alpha1
kind: PodChaos
metadata:
  name: mtls-cert-rotation-test
  namespace: video-conference
spec:
  action: pod-failure
  mode: one
  duration: "30s"
  selector:
    namespaces:
      - video-conference
    labelSelectors:
      app: media-relay-service
  # 配合容器运行时模拟证书文件损坏/过期
  containerNames: ["istio-proxy"]
---
# chaos-network-partition-cross-cluster.yaml
apiVersion: chaos-mesh.org/v1alpha1
kind: NetworkChaos
metadata:
  name: cross-cluster-partition
  namespace: chaos-testing
spec:
  action: partition
  direction: both
  target:
    selector:
      namespaces:
        - istio-system
      labelSelectors:
        app: istio-eastwestgateway
    mode: all
  # 模拟专线抖动：丢包 30%，延迟 200ms
  loss:
    loss: "30"
    correlation: "10"
  delay:
    latency: "200ms"
    correlation: "20"
  duration: "5m"
  scheduler:
    cron: "@once"

# 1. 演练前基线采集
istioctl x metrics --istio-namespace istio-system --prometheus-url http://prometheus:9090 > baseline.json

# 2. 演练中实时监控 (Grafana Dashboard: "Zero Trust Chaos Drill")
# 关键指标：istio_requests_total{response_code=~"403|429|503"}, outlier_detection_ejection_active, pilot_xds_push_errors

# 3. 演练后自动化对比报告
python3 chaos_report.py --baseline baseline.json --current current.json --threshold "error_rate<0.01,latency_p99_increase<20%"

# Ambient 模式：Waypoint 代理承载 L7 策略 (原 Sidecar 职责)
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: video-conference-waypoint
  namespace: video-conference
  labels:
    gateway.networking.k8s.io/gateway-name: video-conference-waypoint
spec:
  gatewayClassName: istio-waypoint
  listeners:
  - name: https
    port: 443
    protocol: HTTPS
    tls:
      mode: Terminate
      certificateRefs:
      - kind: Secret
        name: wildcard-video-conference-tls
---
# L4 授权策略 (ztunnel 层面生效，零开销)
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: media-relay-l4-authz
  namespace: video-conference
spec:
  selector:
    matchLabels:
      app: media-relay-service
  action: ALLOW
  rules:
  - from:
    - source:
        principals: 
        - "spiffe://cluster.local/ns/video-conference/sa/signaling-service"
        - "spiffe://cluster.local/ns/video-conference-gateway/sa/istio-ingressgateway"
  # 无 L7 规则，纯 L4 身份校验，性能损耗极低
---
# L7 授权策略 (Waypoint 层面生效)
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: conference-manager-l7-authz
  namespace: video-conference
spec:
  selector:
    matchLabels:
      gateway.networking.k8s.io/gateway-name: video-conference-waypoint
  action: ALLOW
  rules:
  - to:
    - operation:
        methods: ["POST"]
        paths: ["/api/v1/conferences"]
    when:
    - key: request.auth.claims[role]
      values: ["host", "admin"]

# 1. 验证某 Pod 的有效授权策略 (含继承、优先级)
istioctl x authz check <pod-name>.<namespace> --destination <target-svc>.<namespace>

# 2. 查看 Sidecar 完整配置推送状态 (调试配置不生效)
istioctl proxy-config all <pod-name>.<namespace> -o json | jq '.'

# 3. 实时抓取 Sidecar 访问日志 (含 TLS 信息)
kubectl logs -f <pod-name> -c istio-proxy -n <namespace> | jq 'select(.authority=="media-relay-service")'

# 4. 检查证书有效期与 SDS 状态
istioctl pc secret <pod-name>.<namespace> -o json | jq '.dynamicActiveSecrets[] | select(.name=="default") | {name, expiration}'

# 5. 验证跨集群服务发现
istioctl pc routes <pod-name>.<namespace> --cluster <remote-cluster-name> -o json | jq '.routeConfig[] | select(.name | contains("media-relay"))'

# 6. 性能剖析: Sidecar CPU/内存火焰图
kubectl exec -it <pod-name> -c istio-proxy -n <namespace> -- /usr/local/bin/envoy --cpuprofiler-output /tmp/cpu.prof --cpu-profiler-frequency 1000
# 配合 go tool pprof 分析

# 7. 导出当前网格所有安全资源用于审计归档
istioctl manifest generate --set profile=empty -f <(kubectl get peerauthentication,authorizationpolicy,requestauthentication -A -o yaml) > security-snapshot-$(date +%Y%m%d).yaml