A network policy is a specification of how groups of pods are allowed to communicate with each other and other network endpoints.

NetworkPolicy resources use labels to select pods and define rules which specify what traffic is allowed to the selected pods

cAdvisor

cAdvisor (Container Advisor) provides container users an understanding of the resource usage and performance characteristics of their running containers. It is a running daemon that collects, aggregates, processes, and exports information about running containers.

Istio is a configurable, open source service-mesh layer that connects, monitors, and secures the containers in a Kubernetes cluster

Istio makes it easy to create a network of deployed services with load balancing, service-to-service authentication, monitoring, and more, with few or no code changes in service code. You add Istio support to services by deploying a special sidecar proxy throughout your environment that intercepts all network communication between microservices, then configure and manage Istio using its control plane functionality, which includes:

• Automatic load balancing for HTTP, gRPC, WebSocket, and TCP traffic.
• Fine-grained control of traffic behavior with rich routing rules, retries, failovers, and fault injection.
• A pluggable policy layer and configuration API supporting access controls, rate limits and quotas.
• Automatic metrics, logs, and traces for all traffic within a cluster, including cluster ingress and egress.
• Secure service-to-service communication in a cluster with strong identity-based authentication and authorization.

Istio is designed for extensibility and meets diverse deployment needs. It does this by intercepting and configuring mesh traffic as shown in the following diagram:

 Istio layers on top of Kubernetes, adding containers that are essentially invisible to the programmer and administrator. Called “sidecar” containers, these act as a “person in the middle,” directing traffic and monitoring the interactions between components. The two work in combination in three ways: configuration, monitoring, and management.

Istio features:

• Traffic management
• Security
• telemetry
• vizualization

Reference :

https://istio.io/latest/docs/concepts/what-is-istio/

https://www.ibm.com/cloud/learn/istio

Forseti Security is a collection of community-driven, open-source tools to help you improve the security of your Google Cloud Platform (GCP) environment

• Inventory
• Scanner
• Enforcer
• Explain
• Email Notification

– Keep track of your environment

– Monitor your policy 

– Enforce Rules 

– Understand your policy 

ovidiu@cloudshell:~ (prod)$ gcloud iam service-accounts list

ovidiu@cloudshell:~/oviterraform (prod)$ gcloud compute instances list
Listed 0 items.

Reference:

https://forsetisecurity.org/