Istio and DNS
summary
Istio implements a pod-level DNS interception that uses XDS (not DNS-over-TLS) and always falls back to the platform resolver; it aggregates multicluster services into cluster-local records or lets platform DNS serve private zones. Modern DNS features matter — about 150 million domains and ~6 million signed domains — because DNS spoofing breaks mTLS identity checks. Common fixes: create service entry VIPs for TCP policies, restrict who can create service entries (OPA/Gatekeeper), segregate HTTP/TCP or use SOCKS/HTTP proxy or platform private zones.
AI-written summary · about
chapters (10)
- 0:00Istio and DNS intro
- 3:54DNS security risks
- 7:08Istio DNS interception
- 9:19Security use case
- 11:23Multicluster name visibility
- 13:58TCP/HTTPS policies via DNS
- 17:53DNS policy conflicts
- 19:35Ambient mesh DNS resolver
- 20:40Future of Istio DNS
- 21:49Q&A
related talks
28mMulti-Cluster Service Mesh With Istio
34mRethinking the K8s DNS for the Modern Enterprise
43mHow the DoD Use Istio for End-to-End Encryption and Authentication
36mCross-Cluster Calls Made Easy with Istio 1.1
09mDNS is the entry point for every application on the internet
01h 27mDNS at 30
31mEncryption, Identities, and Everything in Between; Building Secure Kubernetes Networks
34mIt’s Always DNS: So Let’s Break It On Purpose