Chapter 4. Istio ambient mode

Procedure

1. Install the Istio control plane:

   1. Create the istio-system namespace by running the following command:

      $ oc create namespace istio-system

      Copy to Clipboard Toggle word wrap

   2. Create an Istio resource named istio.yaml similar to the following example:

      Example configuration

      apiVersion: sailoperator.io/v1
      kind: Istio
      metadata:
        name: default
      spec:
        namespace: istio-system
        profile: ambient
        values:
          pilot:
            trustedZtunnelNamespace: ztunnel

      Copy to Clipboard Toggle word wrap

      Important

      You must set the profile field to ambient, and configure the .spec.values.pilot.trustedZtunnelNamespace value to match the namespace where the ZTunnel resource will be installed.

   3. Apply the Istio custom resource (CR) by running the following command:

      $ oc apply -f istio.yaml

      Copy to Clipboard Toggle word wrap

   4. Wait for the Istio control plane to contain the Ready status condition by running the following command:

      $ oc wait --for=condition=Ready istios/default --timeout=3m

      Copy to Clipboard Toggle word wrap

2. Install the Istio Container Network Interface (CNI):

   1. Create the istio-cni namespace by running the following command:

      $ oc create namespace istio-cni

      Copy to Clipboard Toggle word wrap

   2. Create the IstioCNI resource named istio-cni.yaml similar to the following example:

      Example configuration

      apiVersion: sailoperator.io/v1
      kind: IstioCNI
      metadata:
        name: default
      spec:
        namespace: istio-cni
        profile: ambient

      Copy to Clipboard Toggle word wrap

      Set the profile field to ambient.

   3. Apply the IstioCNI CR by running the following command:

      $ oc apply -f istio-cni.yaml

      Copy to Clipboard Toggle word wrap

   4. Wait for the IstioCNI pods to contain the Ready status condition by running the following command:

      $ oc wait --for=condition=Ready istios/default --timeout=3m

      Copy to Clipboard Toggle word wrap

3. Install the Ztunnel proxy:

   1. Create the ztunnel namespace for Ztunnel proxy by running the following command:

      $ oc create namespace ztunnel

      Copy to Clipboard Toggle word wrap

      The namespace name for ztunnel project must match the trustedZtunnelNamespace parameter in Istio configuration.

   2. Create the Ztunnel resource named ztunnel.yaml similar to the following example:

      Example configuration

      apiVersion: sailoperator.io/v1alpha1
      kind: ZTunnel
      metadata:
        name: default
      spec:
        namespace: ztunnel
        profile: ambient

      Copy to Clipboard Toggle word wrap

   3. Apply the Ztunnel CR by running the following command:

      $ oc apply -f ztunnel.yaml

      Copy to Clipboard Toggle word wrap

   4. Wait for the Ztunnel pods to contain the Ready status condition by running the following command:

      $ oc wait --for=condition=Ready ztunnel/default --timeout=3m

      Copy to Clipboard Toggle word wrap

Procedure

1. Create the bookinfo namespace by running the following command:

   $ oc create namespace bookinfo

   Copy to Clipboard Toggle word wrap

2. Add the istio-discovery=enabled label to the bookinfo namespace by running the following command:

   $ oc label namespace bookinfo istio-discovery=enabled

   Copy to Clipboard Toggle word wrap

3. Apply the bookinfo YAML file to deploy the bookinfo application by running the following command:

   $ oc apply -n bookinfo -f https://raw.githubusercontent.com/openshift-service-mesh/istio/release-1.26/samples/bookinfo/platform/kube/bookinfo.yaml

   Copy to Clipboard Toggle word wrap

4. Apply the bookinfo-versions YAML file to deploy the bookinfo application by running the following command:

   $ oc apply -n bookinfo -f https://raw.githubusercontent.com/openshift-service-mesh/istio/release-1.26/samples/bookinfo/platform/kube/bookinfo-versions.yaml

   Copy to Clipboard Toggle word wrap

5. Verify that the bookinfo pods are running by entering the following command:

   $ oc -n bookinfo get pods

   Copy to Clipboard Toggle word wrap

   Example output

   NAME                             READY   STATUS    RESTARTS   AGE
   details-v1-54ffdd5947-8gk5h      1/1     Running   0          5m9s
   productpage-v1-d49bb79b4-cb9sl   1/1     Running   0          5m3s
   ratings-v1-856f65bcff-h6kkf      1/1     Running   0          5m7s
   reviews-v1-848b8749df-wl5br      1/1     Running   0          5m6s
   reviews-v2-5fdf9886c7-8xprg      1/1     Running   0          5m5s
   reviews-v3-bb6b8ddc7-bvcm5       1/1     Running   0          5m5s

   Copy to Clipboard Toggle word wrap

6. Verify that the bookinfo application is running by entering the following command:

   $ oc exec "$(oc get pod -l app=ratings -n bookinfo \
     -o jsonpath='{.items[0].metadata.name}')" \
     -c ratings -n bookinfo \
     -- curl -sS productpage:9080/productpage | grep -o "<title>.*</title>"

   Copy to Clipboard Toggle word wrap

7. Add the bookinfo application to the Istio ambient mesh by labeling either the entire namespace or the individual pods:

   1. To include all workloads in the bookinfo namespace, apply the istio.io/dataplane-mode=ambient label to the bookinfo namespace, by running the following command:

      $ oc label namespace bookinfo istio.io/dataplane-mode=ambient

      Copy to Clipboard Toggle word wrap
   2. To include only specific workloads, apply the istio.io/dataplane-mode=ambient label directly to individual pods. See the "Additional resources" section for more details on the labels used to add or exclude workloads in a mesh.
   Note

   Adding workloads to the ambient mesh does not require restarting or redeploying application pods. Unlike sidecar mode, the number of containers in each pod remains unchanged.

8. Confirm that Ztunnel proxy has successfully opened listening sockets in the pod network namespace by running the following command:

   $ istioctl ztunnel-config workloads --namespace ztunnel

   Copy to Clipboard Toggle word wrap

   Example output

   NAMESPACE    POD NAME                       ADDRESS      NODE                        WAYPOINT PROTOCOL
   bookinfo     details-v1-54ffdd5947-cflng    10.131.0.69  ip-10-0-47-239.ec2.internal None     HBONE
   bookinfo     productpage-v1-d49bb79b4-8sgwx 10.128.2.80  ip-10-0-24-198.ec2.internal None     HBONE
   bookinfo     ratings-v1-856f65bcff-c6ldn    10.131.0.70  ip-10-0-47-239.ec2.internal None     HBONE
   bookinfo     reviews-v1-848b8749df-45hfd    10.131.0.72  ip-10-0-47-239.ec2.internal None     HBONE
   bookinfo     reviews-v2-5fdf9886c7-mvwft    10.128.2.78  ip-10-0-24-198.ec2.internal None     HBONE
   bookinfo     reviews-v3-bb6b8ddc7-fl8q2     10.128.2.79  ip-10-0-24-198.ec2.internal None     HBONE
   istio-cni    istio-cni-node-7hwd2           10.0.61.108  ip-10-0-61-108.ec2.internal None     TCP
   istio-cni    istio-cni-node-bfqmb           10.0.30.129  ip-10-0-30-129.ec2.internal None     TCP
   istio-cni    istio-cni-node-cv8cw           10.0.75.71   ip-10-0-75-71.ec2.internal  None     TCP
   istio-cni    istio-cni-node-hj9cz           10.0.47.239  ip-10-0-47-239.ec2.internal None     TCP
   istio-cni    istio-cni-node-p8wrg           10.0.24.198  ip-10-0-24-198.ec2.internal None     TCP
   istio-system istiod-6bd6b8664b-r74js        10.131.0.80  ip-10-0-47-239.ec2.internal None     TCP
   ztunnel      ztunnel-2w5mj                  10.128.2.61  ip-10-0-24-198.ec2.internal None     TCP
   ztunnel      ztunnel-6njq8                  10.129.0.131 ip-10-0-75-71.ec2.internal  None     TCP
   ztunnel      ztunnel-96j7k                  10.130.0.146 ip-10-0-61-108.ec2.internal None     TCP
   ztunnel      ztunnel-98mrk                  10.131.0.50  ip-10-0-47-239.ec2.internal None     TCP
   ztunnel      ztunnel-jqcxn                  10.128.0.98  ip-10-0-30-129.ec2.internal None     TCP

   Copy to Clipboard Toggle word wrap

Procedure

1. Deploy a waypoint proxy in the bookinfo application namespace similar to the following example:

   Example configuration

   apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
   metadata:
     labels:
       istio.io/waypoint-for: service
     name: waypoint
     namespace: bookinfo
   spec:
     gatewayClassName: istio-waypoint
     listeners:
     - name: mesh
       port: 15008
       protocol: HBONE

   Copy to Clipboard Toggle word wrap

2. Apply the waypoint custom resource (CR) by running the following command:

   $ oc apply -f waypoint.yaml

   Copy to Clipboard Toggle word wrap

   The istio.io/waypoint-for: service label indicates that the waypoint handles traffic for services. The label determines the type of traffic processed. For more information, see "Waypoint traffic types".

3. Enroll the bookinfo namespace to use the waypoint by running the following command:

   $ oc label namespace bookinfo istio.io/use-waypoint=waypoint

   Copy to Clipboard Toggle word wrap

Verification

1. Confirm that the waypoint proxy is used by all the services in the bookinfo namespace by running the following command:

   $ istioctl ztunnel-config svc --namespace ztunnel

   Copy to Clipboard Toggle word wrap

   Example output

   NAMESPACE    SERVICE NAME     SERVICE VIP     WAYPOINT   ENDPOINTS
   bookinfo     details          172.30.15.248   waypoint   1/1
   bookinfo     details-v1       172.30.114.128  waypoint   1/1
   bookinfo     productpage      172.30.155.45   waypoint   1/1
   bookinfo     productpage-v1   172.30.76.27    waypoint   1/1
   bookinfo     ratings          172.30.24.145   waypoint   1/1
   bookinfo     ratings-v1       172.30.139.144  waypoint   1/1
   bookinfo     reviews          172.30.196.50   waypoint   3/3
   bookinfo     reviews-v1       172.30.172.192  waypoint   1/1
   bookinfo     reviews-v2       172.30.12.41    waypoint   1/1
   bookinfo     reviews-v3       172.30.232.12   waypoint   1/1
   bookinfo     waypoint         172.30.92.147   None       1/1

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a Gateway resource that allows workloads in the bookinfo namespace to use the waypoint-default from the default namespace similar to the following example:

   Example configuration

   apiVersion: gateway.networking.k8s.io/v1
   kind: Gateway
   metadata:
     name: waypoint-default
     namespace: default
   spec:
     gatewayClassName: istio-waypoint
     listeners:
     - name: mesh
       port: 15008
       protocol: HBONE
       allowedRoutes:
         namespaces:
           from: Selector
           selector:
             matchLabels:
               kubernetes.io/metadata.name: bookinfo

   Copy to Clipboard Toggle word wrap

2. Apply the cross-namespace waypoint by running the following command:

   $ oc apply -f waypoint-default.yaml

   Copy to Clipboard Toggle word wrap

3. Add the labels required to use a cross-namespace waypoint:

   1. Add the istio.io/use-waypoint-namespace label to specify the namespace where the waypoint resides by running the following command:

      $ oc label namespace bookinfo istio.io/use-waypoint-namespace=default

      Copy to Clipboard Toggle word wrap

   2. Add the istio.io/use-waypoint label to specify the waypoint to use by running the following command:

      $ oc label namespace bookinfo istio.io/use-waypoint=waypoint-default

      Copy to Clipboard Toggle word wrap

Procedure

1. Create the traffic routing configuration similar to the following example:

   Example configuration

   apiVersion: gateway.networking.k8s.io/v1
   kind: HTTPRoute
   metadata:
     name: reviews
     namespace: bookinfo
   spec:
     parentRefs:
     - group: ""
       kind: Service
       name: reviews
       port: 9080
     rules:
     - backendRefs:
       - name: reviews-v1
         port: 9080
         weight: 90
       - name: reviews-v2
         port: 9080
         weight: 10

   Copy to Clipboard Toggle word wrap

2. Apply the traffic routing configuration by running the following command:

   $ oc apply -f traffic-route.yaml

   Copy to Clipboard Toggle word wrap

Procedure

1. Create the authorization policy similar to the following example:

   Example configuration

   apiVersion: security.istio.io/v1
   kind: AuthorizationPolicy
   metadata:
     name: productpage-waypoint
     namespace: bookinfo
   spec:
     targetRefs:
     - kind: Service
       group: ""
       name: productpage
     action: ALLOW
     rules:
     - from:
       - source:
           principals:
           - cluster.local/ns/default/sa/curl
       to:
       - operation:
           methods: ["GET"]

   Copy to Clipboard Toggle word wrap

2. Apply the authorization policy by running the following command:

   $ oc apply -f authorization-policy.yaml

   Copy to Clipboard Toggle word wrap

Verification

1. Deploy the curl application in the default namespace by running the following command:

   $ oc apply -n default -f https://raw.githubusercontent.com/openshift-service-mesh/istio/refs/heads/master/samples/curl/curl.yaml

   Copy to Clipboard Toggle word wrap

2. Wait and get the status of the curl deployment by running the following command:

   $ oc -n default rollout status deploy/curl --timeout=3m

   Copy to Clipboard Toggle word wrap

3. Verify that a GET request to the productpage service succeeds with an HTTP 200 response when made from the default/curl pod, by running the following command:

   $ oc -n default exec deploy/curl -- sh -c \
     'curl -s -o /dev/null -w "HTTP %{http_code}\n" http://productpage.bookinfo.svc.cluster.local:9080/productpage'

   Copy to Clipboard Toggle word wrap

4. Verify that a POST request to the same service is denied with an HTTP 403 response due to the applied authorization policy, by running the following command:

   $ oc -n default exec deploy/curl -- sh -c \
     'curl -s -o /dev/null -w "HTTP %{http_code}\n" -X POST http://productpage.bookinfo.svc.cluster.local:9080/productpage'

   Copy to Clipboard Toggle word wrap

5. Verify that a GET request from another service, such as the ratings pod in the bookinfo namespace, is also denied with RBAC: access denied, by running the following command:

   $ oc exec "$(oc get pod -l app=ratings -n bookinfo \
   -o jsonpath='{.items[0].metadata.name}')" \
   -c ratings -n bookinfo \
   -- curl -sS productpage:9080/productpage

   Copy to Clipboard Toggle word wrap

6. Delete the curl application to clean up resources by running the following command:

   $ oc delete -n default -f https://raw.githubusercontent.com/openshift-service-mesh/istio/refs/heads/master/samples/curl/curl.yaml

   Copy to Clipboard Toggle word wrap