kubectl label namespace video-conferencing istio-injection=enabled --overwrite

# peer-auth-strict.yaml
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: video-conferencing
spec:
  mtls:
    mode: STRICT # 强制 mTLS，明文流量将被拒绝

# request-auth-gateway.yaml
apiVersion: security.istio.io/v1beta1
kind: RequestAuthentication
metadata:
  name: gateway-jwt-auth
  namespace: video-conferencing
spec:
  selector:
    matchLabels:
      app: istio-ingressgateway # 作用于入口网关
  jwtRules:
  - issuer: "https://auth.company.com" # OIDC 签发者
    audiences:
    - "video-conferencing-api"
    jwksUri: "https://auth.company.com/.well-known/jwks.json" # 公钥获取地址
    # 可选：从 Header/Cookie/Query 参数提取 Token
    fromHeaders:
    - name: Authorization
      prefix: "Bearer "
    fromParams:
    - "access_token" # 支持 WebSocket 握手阶段 Query 传参
  - issuer: "https://legacy-auth.company.com" # 兼容旧版签发者
    jwksUri: "https://legacy-auth.company.com/jwks"
    audiences:
    - "legacy-video-api"

# authz-signal-service.yaml
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: signal-service-authz
  namespace: video-conferencing
spec:
  selector:
    matchLabels:
      app: signal-service
  action: ALLOW
  rules:
  # 规则1：加入会议 - 必须携带有效会议ID且用户在参会名单中 (需外部授权服务配合)
  - to:
    - operation:
        methods: ["GET", "POST"] # WebSocket 升级通常为 GET
        paths: ["/api/v1/meetings/*/join"]
    when:
    - key: request.auth.claims[meeting_id] # JWT Claim 自定义字段
      values: ["*"] # 存在即可，具体业务逻辑建议下沉至外部授权
    - key: request.auth.claims[role]
      values: ["host", "participant", "guest"]
  
  # 规则2：创建会议 - 仅认证用户
  - to:
    - operation:
        methods: ["POST"]
        paths: ["/api/v1/meetings"]
    when:
    - key: request.auth.principal # SPIFFE ID 或 JWT sub
      values: ["*"]
  
  # 规则3：健康检查/指标暴露 - 允许内部监控系统无认证访问 (需谨慎限制来源 IP)
  - from:
    - source:
        principals: ["cluster.local/ns/monitoring/sa/prometheus"]
    to:
    - operation:
        paths: ["/healthz", "/metrics"]

# ext-authz-filter.yaml (通过 EnvoyFilter 挂载至 Sidecar/网关)
apiVersion: networking.istio.io/v1beta1
kind: EnvoyFilter
metadata:
  name: signal-ext-authz
  namespace: video-conferencing
spec:
  workloadSelector:
    labels:
      app: signal-service
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.filters.http.ext_authz
        typed_config:
          "@type": type.googleapis.com/envoy.extensions.filters.http.ext_authz.v3.ExtAuthz
          transport_api_version: V3
          grpc_service:
            envoy_grpc:
              cluster_name: ext-authz-grpc-cluster # 需预先定义 Cluster
            timeout: 2s
          failure_mode_allow: false # 严格模式：授权服务不可用则拒绝
          with_request_body:
            max_request_bytes: 1024
            allow_partial: true

# dr-media-service.yaml
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: media-service-dr
  namespace: video-conferencing
spec:
  host: media-service
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 10000 # 单个 Sidecar 连接池上限
      http:
        h2UpgradePolicy: UPGRADE # 支持 HTTP/2 多路复用
        http1MaxPendingRequests: 5000
        http2MaxRequests: 10000
        maxRequestsPerConnection: 100
    outlierDetection: # 熔断策略
      consecutive5xxErrors: 3 # 连续 3 次 5xx 错误
      interval: 10s # 检测间隔
      baseEjectionTime: 30s # 剔除时长
      maxEjectionPercent: 50 # 最大剔除比例 50%
      minHealthPercent: 30 # 最小健康实例比例

# local-rate-limit.yaml (本地限流示例，无需外部 RateLimit Server)
apiVersion: networking.istio.io/v1beta1
kind: EnvoyFilter
metadata:
  name: gateway-local-ratelimit
  namespace: istio-system
spec:
  workloadSelector:
    labels:
      istio: ingressgateway
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: GATEWAY_INBOUND
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.filters.http.local_ratelimit
        typed_config:
          "@type": type.googleapis.com/udpa.type.v1.TypedStruct
          type_url: type.googleapis.com/envoy.extensions.filters.http.local_ratelimit.v3.LocalRateLimit
          value:
            stat_prefix: http_local_rate_limiter
            token_bucket:
              max_tokens: 10000 # 桶容量
              tokens_per_fill: 1000 # 每秒填充
              fill_interval: 1s
            filter_enabled:
              runtime_key: local_rate_limit_enabled
              default_value:
                numerator: 100
                denominator: HUNDRED

# vs-signal-canary.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: signal-service-vs
  namespace: video-conferencing
spec:
  hosts: ["signal-service"]
  http:
  - match:
    - headers:
        x-canary-version:
          exact: "v2" # 灰度标识 Header
    route:
    - destination:
        host: signal-service
        subset: v2
      weight: 100
  - route:
    - destination:
        host: signal-service
        subset: v1
      weight: 90
    - destination:
        host: signal-service
        subset: v2
      weight: 10 # 10% 流量灰度
    mirror:
      host: signal-service
      subset: v2 # 镜像 100% 流量到 v2 观察日志/指标，不返回响应
    mirrorPercentage:
      value: 100.0

# telemetry-accesslog.yaml
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: video-conferencing-accesslog
  namespace: video-conferencing
spec:
  selector:
    matchLabels:
      app: signal-service # 或全局不写 selector
  accessLogging:
  - providers:
    - name: otel # 或 stdout/file
    filter:
      expression: |
        request.headers["x-request-id"] != "" && 
        (response.code >= 400 || request.path.startsWith("/api/v1/meetings"))

# 在集群 A (Control Plane) 创建远程集群 B 的 Secret
# 通过 istioctl create-remote-secret --context=cluster-b --name=cluster-b | kubectl apply -f - --context=cluster-a
# 关键：配置 MeshConfig 信任域别名，允许跨集群服务发现
apiVersion: istio.io/v1alpha1
kind: MeshConfig
metadata:
  name: config
  namespace: istio-system
spec:
  trustDomain: video.company.com
  trustDomainAliases: ["video.company.com", "edge.video.company.com"] # 边缘集群别名
  defaultConfig:
    proxyMetadata:
      # 启用跨集群服务发现 DNS 解析
      PILOT_ENABLE_CROSS_CLUSTER_WORKLOAD_ENTRY: "true"

# workloadentry-media-edge.yaml
apiVersion: networking.istio.io/v1beta1
kind: WorkloadEntry
metadata:
  name: media-sfu-shanghai-01
  namespace: video-conferencing
  labels:
    app: media-sfu
    topology.istio.io/region: cn-shanghai
    workload.type: baremetal # 标识非 Pod 工作负载
spec:
  address: 10.0.1.50 # 裸金属真实 IP
  labels:
    app: media-sfu
    version: v2.4.1
  network: onprem-shanghai # 定义网络拓扑，配合 Gateway 实现就近接入
  serviceAccount: media-sfu-sa # 映射 SPIFFE ID: spiffe://video.company.com/ns/video-conferencing/sa/media-sfu-sa
---
# 为边缘节点配置专属 Waypoint 代理 (共享代理模式，节省资源)
apiVersion: networking.istio.io/v1beta1
kind: Waypoint
metadata:
  name: media-edge-waypoint
  namespace: video-conferencing
spec:
  selector:
    matchLabels:
      app: media-sfu

# cilium-media-policy.yaml
apiVersion: "cilium.io/v2"
kind: CiliumNetworkPolicy
metadata:
  name: media-sfu-udp-protection
  namespace: video-conferencing
spec:
  endpointSelector:
    matchLabels:
      app: media-sfu
  ingress:
  - fromEndpoints:
    - matchLabels:
        app: signal-service # 仅允许信令服务触发媒体协商 (通过 gRPC 下发 ICE Candidate)
    toPorts:
    - ports:
      - port: "10000-20000" # RTP/RTCP 端口范围
        protocol: UDP
      rules:
        udp:
        # 可选：结合 eBPF 解析 RTP Header，校验 SSRC 合法性 (需 Cilium 1.13+)
        - sourcePort: 5060 # 示例：仅允许特定信令端口触发的媒体流 (需业务配合)
  egress:
  - toEndpoints:
    - matchLabels:
        app: recording-service # 允许流向录制服务
    toPorts:
    - ports:
      - port: "30000-40000"
        protocol: UDP

# wasm-audit-filter.yaml (编译为 .wasm 插件挂载至 Sidecar/Waypoint)
apiVersion: networking.istio.io/v1beta1
kind: EnvoyFilter
metadata:
  name: recording-audit-wasm
  namespace: video-conferencing
spec:
  workloadSelector:
    labels:
      app: recording-service
  configPatches:
  - applyTo: HTTP_FILTER
    match:
      context: SIDECAR_INBOUND
      listener:
        filterChain:
          filter:
            name: envoy.filters.network.http_connection_manager
    patch:
      operation: INSERT_BEFORE
      value:
        name: envoy.filters.http.wasm
        typed_config:
          "@type": type.googleapis.com/udpa.type.v1.TypedStruct
          type_url: type.googleapis.com/envoy.extensions.filters.http.wasm.v3.Wasm
          value:
            config:
              name: "recording_audit"
              root_id: "audit_root"
              vm_config:
                vm_id: "audit_vm"
                runtime: "envoy.wasm.runtime.v8"
                code:
                  local:
                    inline_string: |
                      // WASM 伪代码逻辑：
                      // 1. 拦截 /api/v1/recordings/start 请求
                      // 2. 提取 JWT Claims (user_id, meeting_id, tenant_id)
                      // 3. 生成审计事件: {event: "RECORD_START", hash: SHA256(payload), prev_hash: chain_tail}
                      // 4. 通过 gRPC 发送至不可变审计存储 (如 Kafka + Immutable Ledger / 区块链存证)
                      // 5. 响应头注入 X-Audit-TxID 供客户端核验
            # 省略具体 WASM 字节码配置...

# dlp-ext-authz.yaml (集成第三方 DLP 服务)
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: ai-training-dlp-check
  namespace: video-conferencing
spec:
  selector:
    matchLabels:
      app: ai-training-gateway
  action: CUSTOM
  provider:
    name: dlp-ext-authz # 引用 EnvoyFilter 定义的 ext_authz provider
  rules:
  - to:
    - operation:
        paths: ["/v1/datasets/upload"]
    when:
    - key: request.auth.claims[scope]
      values: ["ai_training_write"]

graph TD
    A[当前 Sidecar 模式] --> B{媒体节点是否裸金属/VM?}
    B -- 是 --> C[优先迁移边缘媒体节点至 Ambient<br/>利用 WorkloadEntry + Ztunnel 统一纳管]
    B -- 否 (全 K8s) --> D{单节点 Pod 密度 > 50?}
    D -- 是 --> E[全量迁移 Ambient 节省资源成本]
    D -- 否 --> F[核心信令/网关保留 Sidecar (成熟 L7 能力)<br/>媒体服务试点 Ambient]
    C --> G[验证 HBONE mTLS 对 SRTP 吞吐影响]
    E --> G
    F --> G
    G --> H{性能/稳定性达标?}
    H -- 是 --> I[全面推广 Ambient]
    H -- 否 --> J[定位瓶颈: Waypoint 扩容 / Ztunnel 内核参数调优]

# policy/test/deny_insecure_ingress.rego
package istio.security

# 规则：禁止任何入口网关配置 PERMISSIVE mTLS
deny[msg] {
  input.kind == "PeerAuthentication"
  input.spec.mtls.mode == "PERMISSIVE"
  msg := sprintf("PeerAuthentication %s in namespace %s uses PERMISSIVE mode, must be STRICT", [input.metadata.name, input.metadata.namespace])
}

# 规则：AuthorizationPolicy 必须显式定义 action (ALLOW/DENY/CUSTOM)，禁止默认允许
deny[msg] {
  input.kind == "AuthorizationPolicy"
  not input.spec.action
  msg := sprintf("AuthorizationPolicy %s missing explicit action field", [input.metadata.name])
}

# 规则：视频会议核心服务必须绑定 RequestAuthentication
deny[msg] {
  input.kind == "AuthorizationPolicy"
  input.spec.selector.matchLabels.app in ["signal-service", "media-controller"]
  not exists_jwt_provider(input)
  msg := sprintf("Critical service %s missing RequestAuthentication binding", [input.spec.selector.matchLabels.app])
}

exists_jwt_provider(policy) {
  # 逻辑：检查同命名空间是否存在匹配的 RequestAuthentication
  # 此处简化，实际需遍历 input 列表或查询 K8s API
  true 
}

# .gitlab-ci.yml / Jenkinsfile 片段
stages:
  - validate
  - security-test
  - chaos-drill

istio-lint:
  stage: validate
  script:
    - istioctl analyze -f manifests/ --use-kube=false --all-namespaces
    - opa eval --data policy/ --input manifests/ "data.istio.security.deny" --format pretty
  allow_failure: false

authz-integration-test:
  stage: security-test
  script:
    - kubectl apply -f test/namespace.yaml
    - kubectl apply -f manifests/ # 应用策略
    - go test -v ./tests/security/... # 运行集成测试套件 (含正向/负向用例)
  services:
    - name: kind:latest # 或使用远程测试集群

func TestAuthorizationPolicyEnforcement(t *testing.T) {
    // 1. 部署测试负载 (攻击者 Pod, 受害者 Service)
    // 2. 从攻击者 Pod 发起无 Token 请求
    resp, err := http.Get("http://signal-service/api/v1/meetings/123/join")
    assert.NoError(t, err)
    assert.Equal(t, 403, resp.StatusCode) // 期望被 RBAC 拦截
    
    // 3. 校验 Istio 审计日志 (通过 Loki/ES API 查询)
    logs := queryLoki(`{namespace="video-conferencing", app="signal-service"} |= "RBAC_DENIED" | json | source_ip="<attacker_pod_ip>"`)
    assert.Len(t, logs, 1, "Audit log missing for denied request")
}

# vpa-sidecar.yaml (针对信令服务 Sidecar)
apiVersion: autoscaling.k8s.io/v1
kind: VerticalPodAutoscaler
metadata:
  name: signal-service-vpa
  namespace: video-conferencing
spec:
  targetRef:
    apiVersion: "apps/v1"
    kind: Deployment
    name: signal-service
  updatePolicy:
    updateMode: "Auto" # 或 Initial 仅重启时生效
  resourcePolicy:
    containerPolicies:
    - containerName: istio-proxy # Sidecar 容器名
      minAllowed:
        cpu: "50m"
        memory: "64Mi"
      maxAllowed:
        cpu: "1000m" # 单核上限，防止挤占业务容器
        memory: "512Mi"
      controlledResources: ["cpu", "memory"]
      # 关键：基于自定义指标 (istio_proxy_concurrent_streams) 扩容
      # 需配合 Prometheus Adapter 将指标注入 HPA/VPA