Istio

The build infrastructure for istio.io currently carries a complete archived copy of the site for each release of Istio. These archived versions should be separated to their own branch, with only the supported versions published. We should also separate out content which is not version-specific (e.g. the home page, news and blogs) so that only the latest version of this content is visible online. Expected Outcome: Updated publishing infrastructure for istio.io which separates evergreen content (home page, blogs) with versioned content (documentation). Drop-downs per docs page allow switching between the supported versions.

Up until version 1.16, [Istio](https://istio.io/) published [performance and scale testing results](https://istio.io/v1.16/docs/ops/deployment/performance-and-scalability/). These should be returned to service, and updated to support ambient mesh. Third-party benchmarking tools should be updated to support testing the performance of ambient mesh. - Expected Outcome: Performance testing pages are returned to istio.io, and include both sidecar and ambient mesh results.

Istio extends Kubernetes to establish a programmable, application-aware network. Working with both Kubernetes and traditional workloads, Istio brings standard, universal traffic management, telemetry, and security to complex deployments Istio does not support HTTPs based metric scraping for control plane, gateway, and Envoy sidecar metrics This could have some security related consequences: - An attacker might find some sensitive information that they can use for their advantage. For example, Envoy /stats endpoint can be used to enumerate all upstream services in the cluster. - In theory an attacker could masquerade the metrics endpoint(s) and inject fake data to monitoring systems, in order to e.g. hide an ongoing attack, confuse the system to autoscale up/down etc. It would be nice to protect the metrics endpoints with TLS, using mutual authentication. While this feature is a big one covering multiple components, the easiest component alone is intended to be covered as part of this internship. Expected Outcome: - Implement HTTPS metrics for ztunnel component - Add unit tests and integration tests for the feature - Add documentation for the functionality

Ambient mesh is now one of the biggest features in Istio, but it is in its early stage. We are in the process of improving the test coverage for Ambient Mesh in order to move it to Beta. Ztunnel works as shared data plane within a node, it subscribes to `Workload` and `Authorization` resources, both need to be well tested. Expected Outcome: - Enhanced UnitTest coverage for `Workload` and `Authorization` Delta xDS/Stow interface. - Enhanced integration tests for ztunnel Authorization Policy Upstream Issues: - https://github.com/orgs/istio/projects/9 - https://github.com/istio/ztunnel/issues/251

Istio is a service mesh platform used by thousands of companies to secure and manage their microservices traffic, most often in a single Kubernetes cluster. However, the ability to operate across multiple clusters is an important feature in Istio's traditional Sidecar mode, and work to support it in Istio's Ambient mode is making rapid progress. To call any feature complete, comprehensive testing is needed. Given that multicluster Istio Ambient is a new mode of operating, we will need to both adapt tests for existing features to ensure they work across multiple clusters, as well as identify multi-cluster specific scenarios we want to codify in tests. Expected Outcome: 1. Audit existing ambient integration tests for cases that do not support multi-cluster testing patterns. 2. Refactor those tests, using Istio's testing infrastructure to cover features within a multi-cluster environment. 3. Work with Istio maintainers to identify opportunities for testing new scenarios that exist only for ambient multi-cluster. 4. As documentation is written for https://istio.io, verify that the user instructions (kubectl commands, YAML snippets, etc.) actually work end-to-end. 5. Gain hands-on experience with Istio's codebase, service mesh architectures, and Kubernetes multi-clust......