#Installing Istio ambient mode

You can deploy Istio in ambient mode on Alauda Container Platform with Alauda Service Mesh Operator 2.1.1 or later.

#Prerequisites

• The Alauda Container Platform Networking for Multus plugin must be installed, and kube-ovn must be v4.1.5 or later.
• The cluster version matches the Istio version you plan to deploy: Istio 1.30 supports Kubernetes 1.32 to 1.36, and Istio 1.28 supports Kubernetes 1.30 to 1.34.
• Alauda Service Mesh Operator 2.1.1 or later is installed.
• An active ACP CLI (kubectl) session by a cluster administrator with the cluster-admin role.
• You have istioctl installed locally so that you can use to run these instructions.

#Procedure

#Install the Istio Container Network Interface (CNI)

1. Create the istio-cni namespace and add a label istio-discovery=enabled:

   kubectl create namespace istio-cni
   kubectl label namespace istio-cni istio-discovery=enabled

2. Create the IstioCNI resource named istio-cni.yaml:

   apiVersion: sailoperator.io/v1
   kind: IstioCNI
   metadata:
     name: default
   spec:
     version: v1.30.3
     namespace: istio-cni
     profile: ambient
     values:
       cni:
         cniConfDir: /etc/cni/multus/net.d
         excludeNamespaces:
           - istio-cni
           - kube-system
   1. You must set the profile field to ambient.
   NOTE

   • Do not add a namespace that holds ambient workloads to values.cni.excludeNamespaces. Since Istio 1.30, the Istio CNI agent honors this list and removes enrolled workloads in an excluded namespace from the mesh.
   • DNS capture is enabled by default for ambient workloads. The Istio CNI reconciles the in-pod redirection rules of enrolled workloads when it starts, so you do not have to restart them.

3. Apply the IstioCNI CR:

   kubectl apply -f istio-cni.yaml

4. Wait for the IstioCNI pods to become ready:

   kubectl wait --for=condition=Ready istiocnis/default --timeout=3m

#Install the Istio control plane

1. Create the istio-system namespace and add a label istio-discovery=enabled:

   kubectl create namespace istio-system
   kubectl label namespace istio-system istio-discovery=enabled

2. Create an Istio resource named istio.yaml:

   apiVersion: sailoperator.io/v1
   kind: Istio
   metadata:
     name: default
   spec:
     version: v1.30.3
     namespace: istio-system
     profile: ambient
     values:
       pilot:
         trustedZtunnelNamespace: ztunnel
       meshConfig:
         discoverySelectors:
           - matchLabels:
               istio-discovery: enabled
   1. You must set the profile field to ambient.
   2. You must configure .spec.values.pilot.trustedZtunnelNamespace to match the namespace where the ZTunnel resource will be installed..
   3. The discoverySelectors configuration ensures that the control plane only monitors namespaces labeled with istio-discovery=enabled, which helps reduce configuration overhead and enables multiple service meshes to coexist on the same cluster. See Discovery selectors in ambient mode for details.

3. Apply the Istio custom resource (CR):

   kubectl apply -f istio.yaml

4. Wait for the Istio control plane to become ready:

   kubectl wait --for=condition=Ready istios/default --timeout=3m

#Install the ZTunnel proxy

1. Create the ztunnel namespace and add a label istio-discovery=enabled:

   kubectl create namespace ztunnel
   kubectl label namespace ztunnel istio-discovery=enabled
   NOTE

   The namespace name for the ZTunnel resource must match the trustedZtunnelNamespace parameter in the Istio configuration.

2. Create the ZTunnel resource named ztunnel.yaml:

   apiVersion: sailoperator.io/v1
   kind: ZTunnel
   metadata:
     name: default
   spec:
     version: v1.30.3
     namespace: ztunnel
     values:
       ztunnel:
         resources:
           requests:
             cpu: 200m
             memory: 512Mi
           limits:
             cpu: 2000m
             memory: 1024Mi

3. Apply the ZTunnel CR:

   kubectl apply -f ztunnel.yaml

4. Wait for the ZTunnel pods to become ready:

   kubectl wait --for=condition=Ready ztunnel/default --timeout=3m