Install Gloo-managed ambient meshes (alpha)

By using the Gloo operator to manage your service meshes, you no longer need to manually install and manage the istiod control plane. Instead, you provide minimal Istio configuration to the operator in a ServiceMeshController custom resource, and the operator translates this configuration into a managed istiod control plane in your cluster for you. The operator reduces both the amount of configuration required to deploy Istio, and the overhead required to manage the lifecycle of Istio resources in your cluster.

Before you begin link

1. Save the patch version of the Solo distribution of Istio that you want to install. For supported Istio versions in Gloo Mesh Core, see the Ambient section of the Istio images built by Solo.io support article.

     export ISTIO_VERSION=1.24.2
     

   Be sure to review the following known Istio version restrictions.

   warning

   In Istio 1.22.0-1.22.3, the ISTIO_DELTA_XDS environment variable must be set to false. For more information, see this upstream Istio issue. Note that this issue is resolved in Istio 1.22.4.
   
   In Gloo Mesh Core version 2.6, ambient mode requires the Solo distribution of Istio version 1.22.3 or later (1.22.3-solo).
   
   

   Istio 1.20 is supported only as patch version 1.20.1-patch1 and later. Do not use patch versions 1.20.0 and 1.20.1, which contain bugs that impact several Gloo Mesh Core features that rely on Istio ServiceEntries.

2. If you use Google Kubernetes Engine (GKE) clusters, create the following ResourceQuota in the istio-system namespace. For more information about this requirement, see the community Istio documentation.

     kubectl create namespace istio-system
   kubectl -n istio-system apply -f - <<EOF
   apiVersion: v1
   kind: ResourceQuota
   metadata:
     name: gcp-critical-pods
     namespace: istio-system
   spec:
     hard:
       pods: 1000
     scopeSelector:
       matchExpressions:
       - operator: In
         scopeName: PriorityClass
         values:
         - system-node-critical
   EOF
     

Single cluster link

Install an ambient service mesh with the Gloo operator in a single-cluster Gloo Mesh Core environment.

1. Install the Gloo operator to the gloo-mesh namespace. This operator deploys and manages your Istio installation.

     helm install gloo-operator oci://us-docker.pkg.dev/solo-public/gloo-operator-helm/gloo-operator \
     --version 0.1.0-beta.2 \
     -n gloo-mesh \
     --create-namespace
     

2. Verify that the operator pod is running.

     kubectl get pods -n gloo-mesh | grep operator
     

   Example output:

     gloo-operator-78d58d5c7b-lzbr5     1/1     Running   0          48s
     

3. Create a ServiceMeshController custom resource to configure an Istio installation. For a description of each configurable field, see the ServiceMeshController reference.

     kubectl apply -n gloo-mesh -f -<<EOF
   apiVersion: operator.gloo.solo.io/v1
   kind: ServiceMeshController
   metadata:
     name: managed-istio
     labels:
       app.kubernetes.io/name: managed-istio
   spec:
     dataplaneMode: Ambient
     installNamespace: istio-system
     version: ${ISTIO_VERSION}
   EOF
     

4. Verify that the ServiceMeshController is ready. In the Status section of the output, make sure that all statuses are True, and that the phase is SUCCEEDED.

     kubectl describe servicemeshcontroller -n gloo-mesh managed-istio
     

   Example output:

     Name:         managed-istio
   Namespace:    
   Labels:       app.kubernetes.io/name=managed-istio
                 istio.io/rev=test
   Annotations:  <none>
   API Version:  operator.gloo.solo.io/v1
   Kind:         ServiceMeshController
   Metadata:
     Creation Timestamp:  2024-12-27T20:46:23Z
     Generation:          1
     Resource Version:    60452302
     UID:                 1335ca57-2ca2-4f3d-8e00-a56dec1aa0c5
   Spec:
     Dataplane Mode:  Sidecar
     Distribution:    Standard
     Image:
       Repository:          <repo>
     Install Namespace:     istio-system
     On Conflict:           Abort
     Traffic Capture Mode:  Auto
     Version:               1.24.1-patch1
   Status:
     Conditions:
       Last Transition Time:  2024-12-27T20:47:01Z
       Message:               Manifests initialized
       Observed Generation:   1
       Reason:                ManifestsInitialized
       Status:                True
       Type:                  Initialized
       Last Transition Time:  2024-12-27T20:47:02Z
       Message:               CRDs installed
       Observed Generation:   1
       Reason:                CRDInstalled
       Status:                True
       Type:                  CRDInstalled
       Last Transition Time:  2024-12-27T20:47:02Z
       Message:               Deployment succeeded
       Observed Generation:   1
       Reason:                DeploymentSucceeded
       Status:                True
       Type:                  ControlPlaneDeployed
       Last Transition Time:  2024-12-27T20:47:02Z
       Message:               Deployment succeeded
       Observed Generation:   1
       Reason:                DeploymentSucceeded
       Status:                True
       Type:                  CNIDeployed
       Last Transition Time:  2024-12-27T20:47:02Z
       Message:               Deployment succeeded
       Observed Generation:   1
       Reason:                DeploymentSucceeded
       Status:                True
       Type:                  WebhookDeployed
       Last Transition Time:  2024-12-27T20:47:02Z
       Message:               All conditions are met
       Observed Generation:   1
       Reason:                SystemReady
       Status:                True
       Type:                  Ready
     Phase:                   SUCCEEDED
   Events:                    <none>
     

5. Verify that the istiod control plane, Istio CNI, and ztunnel pods are running.

     kubectl get pods -n istio-system
     

6. If you plan to use L7 traffic policies, be sure to apply the CRDs for the Kubernetes Gateway API to your cluster, which are required to create waypoint proxies.

     kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v/standard-install.yaml
     

ServiceMeshController reference link

Review the following configurable fields for the ServiceMeshController custom resource.

Next steps link

Add apps to the ambient mesh.