Considerations

Before you install Istio in ambient mode, review the following considerations and requirements.

Gloo 2.6 lifecycle manager changes

The Solo Istio Lifecycle Manager helps you manage your Istio installations and upgrades more easily. In Gloo Mesh Core version 2.6 and later, the Istio lifecycle manager feature is changed so that an Istio lifecycle agent now deploys and manages the Istio installations to your clusters, instead of the Gloo agent. Additionally, the Istio lifecycle agent now translates input IstioOperator configuration into Istio Helm chart values to deploy the installations, instead of deploying installations based on the IstoOperator configuration directly.

Requirements

  • In Gloo Mesh Core version 2.6, ambient mode requires the Solo distribution of Istio version 1.22.3 or later (1.22.3-solo).
  • In Istio 1.22, the ISTIO_DELTA_XDS environment variable must be set to false. For more information, see this upstream Istio issue.

Single-cluster limitation

Currently, Istio in ambient mode is supported only for single clusters. Ambient mode in a multicluster environment where apps in different clusters can communicate through east-west routing as part of a single service mesh is not supported. However, you can still use your management cluster to deploy separate ambient service meshes to multiple, individual workload clusters.

Revision and canary upgrade limitations

Currently, revisions are not supported for ambient installations. This limitation is planned to be addressed in a future release. To ensure that you can install and upgrade your ambient service mesh smoothly, do not specify a named revision in the spec.installations.revision field. If necessary, you can explicitly set spec.installations.revision to "".

Because revisions are not supported yet, canary upgrades are also not supported. Instead, you can use the lifecycle manager to perform only in-place upgrades of ambient Istio installations.

Prepare your environment

  1. Install Gloo Mesh Core by following the multicluster getting started guide or the Helm setup guide. Do not install Istio as part of your setup.

  2. Set the names of your clusters from your infrastructure provider. If your clusters have different names, specify those names instead.

      export MGMT_CLUSTER=mgmt
export REMOTE_CLUSTER=cluster1
  3. Save the kubeconfig contexts for your clusters. Run kubectl config get-contexts, look for your cluster in the CLUSTER column, and get the context name in the NAME column. Note: Do not use context names with underscores. The generated certificate that connects workload clusters to the management cluster uses the context name as a SAN specification, and underscores in SAN are not FQDN compliant. You can rename a context by running kubectl config rename-context "<oldcontext>" <newcontext>.
      export MGMT_CONTEXT=<management-cluster-context>
export REMOTE_CONTEXT=<remote-cluster-context>

  4. Set environment variables for the Solo distribution of Istio repository and image version that you want to install. You can find these values in the Istio images built by Solo.io support article.

      export REPO=<repo-key>
export ISTIO_IMAGE=1.22.3-solo

  5. If other Istio installations already exist in your clusters, you must first uninstall any existing Istio installations. You currently cannot use the lifecycle manager alongside or to takeover unmanaged Istio installations that you install by using Helm, istioctl, or an IstioOperator.

  6. If you use Google Kubernetes Engine (GKE) clusters, create the following ResourceQuota in the istio-system namespace of the workload cluster. For more information about this requirement, see the community Istio documentation.

      kubectl --context $REMOTE_CONTEXT create namespace istio-system
kubectl --context $REMOTE_CONTEXT -n istio-system apply -f - <<EOF
apiVersion: v1
kind: ResourceQuota
metadata:
  name: gcp-critical-pods
  namespace: istio-system
spec:
  hard:
    pods: 1000
  scopeSelector:
    matchExpressions:
    - operator: In
      scopeName: PriorityClass
      values:
      - system-node-critical
EOF

Deploy the Istio ambient control plane

  1. Create an IstioLifecycleManager resource in your management cluster to deploy an istiod control plane in ambient mode to the workload cluster.

      kubectl apply --context $MGMT_CONTEXT -f- <<EOF
apiVersion: admin.gloo.solo.io/v2
kind: IstioLifecycleManager
metadata:
  name: istiod-control-plane
  namespace: gloo-mesh
spec:
  installations:
    - clusters:
        - name: $REMOTE_CLUSTER
      istioOperatorSpec:
        hub: $REPO
        tag: $ISTIO_IMAGE
        profile: ambient
          cni:
            namespace: istio-system
            enabled: true
        values:
          ztunnel:
            env:
              L7_ENABLED: true
EOF

  2. Verify that the components of the Istio ambient mesh and the Istio CNI pods are successfully installed. Because the ztunnel and the CNI are deployed as daemon sets, the number of ztunnel pods and CNI pods each equal the number of nodes in your cluster. Note that it might take a few seconds for the pods to become available.

      kubectl get pods --context $REMOTE_CONTEXT -A | grep istio

    Example output:

      istiod-d765ff7cf-46dbm                  1/1     Running   0          2m4s
ztunnel-648wc                           1/1     Running   0          2m8s
ztunnel-6rhp5                           1/1     Running   0          2m8s
ztunnel-hllxg                           1/1     Running   0          2m8s
istio-cni-node-6q26l                    1/1     Running   0          1m43s
istio-cni-node-7gg8k                    1/1     Running   0          1m43s
istio-cni-node-lcrcd                    1/1     Running   0          1m43s

  3. Optional: To send requests to sample apps from outside your Gloo Mesh Core setup, you can use the following gateway lifecycle manager resource to also deploy an Istio ingress gateway. Note that in an ambient service mesh, gateways do not require an ambient profile.

      kubectl --context $MGMT_CONTEXT -n gloo-mesh apply -f - <<EOF
apiVersion: admin.gloo.solo.io/v2
kind: GatewayLifecycleManager
metadata:
  name: istio-ingressgateway
  namespace: gloo-mesh
spec:
  installations:
    - clusters:
        - name: $REMOTE_CLUSTER
      istioOperatorSpec:
        hub: $REPO
        tag: $ISTIO_IMAGE
        profile: empty
        components:
          ingressGateways:
          - enabled: true
            k8s:
              service:
                ports:
                  # Port for health checks on path /healthz/ready.
                  # For AWS ELBs, must be listed as the first port
                  - name: status-port
                    port: 15021
                    targetPort: 15021
                  - name: http2
                    port: 80
                    targetPort: 8080
                  - name: https
                    port: 443
                    targetPort: 8443
                  - name: tls
                    port: 15443
                    targetPort: 15443
                selector:
                  istio: ingressgateway
                type: LoadBalancer
            label:
              app: istio-ingressgateway
              istio: ingressgateway
            name: istio-ingressgateway
            namespace: gloo-mesh-gateways
EOF

  4. In the workload cluster, verify that the ingress gateway pod has a status of RUNNING and that the load balancer service has an external address.

      kubectl get pods,svc -n gloo-mesh-gateways --context $REMOTE_CONTEXT

    Example output:

      NAME                                    READY   STATUS    RESTARTS   AGE
istio-ingressgateway-665d46686f-nhh52   1/1     Running   0          106s

NAME                        TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)                                                                                                      AGE
istio-ingressgateway        LoadBalancer   10.96.252.49    <externalip>  15021:32378/TCP,80:30315/TCP,443:32186/TCP,31400:30313/TCP,15443:31632/TCP                                   2m2s

Next

Deploy sample apps and add them to the ambient mesh.