istioctl ec2 add-workload

Reference for the istioctl ec2 add-workload command.

istioctl ec2 add-workload

Add a workload identity to an EC2 instance in the mesh.

Synopsis

‘istioctl ec2 add-workload’ configures an EC2 instance to run a workload identity in the ambient mesh using IAM STS authentication. This command:

Tags the EC2 instance with discovery metadata so istiod automatically creates WorkloadEntry and Service resources for this workload.
Creates and annotates the Kubernetes ServiceAccount with the IAM role ARN for authentication.
On the first workload (auto-detected), generates a BOOTSTRAP_TOKEN to start ztunnel on the VM.

The IAM role ARN is auto-discovered from the instance’s IAM instance profile. Use –role-arn to override.

istioctl ec2 add-workload <workload-name> [flags]

Examples

  # Add workload 'web-api' to instance i-0abc123, listening on port 8080
  istioctl ec2 add-workload web-api \
    --instance i-0abc123 \
    --namespace vm-apps \
    --ports http:80:8080

  # Force re-generation of the bootstrap token
  istioctl ec2 add-workload web-api \
    --instance i-0abc123 \
    --namespace vm-apps \
    --ports http:80:8080 \
    --bootstrap

  # Override the auto-discovered IAM role ARN
  istioctl ec2 add-workload web-api \
    --instance i-0abc123 \
    --namespace vm-apps \
    --ports http:80:8080 \
    --role-arn arn:aws:iam::123456789012:role/my-role

Options

      --bootstrap                   Force re-generation of the bootstrap token, even if the instance appears already bootstrapped.
      --external                    Mark the workload as external to the cluster network (uses east-west gateway).
      -h, --help                    help for add-workload
      --instance string             EC2 instance ID (required)
      --ports string                Port configuration as 'protocol:port[:targetPort][/...]' (e.g. 'http:80:8080/grpc:9090'). Defaults to 'http:80'.
      --profile string              AWS CLI profile to use. Defaults to the default AWS CLI profile.
      --role-arn string             IAM role ARN to associate with the workload. Auto-discovered from the instance profile if not specified.
      -s, --service-account string  Kubernetes service account for the workload identity. Defaults to the workload name.
      --use-public-ip               Use the instance's public IP for routing instead of the private IP.

Options inherited from parent commands

      --as string                  Username to impersonate for the operation. User could be a regular user or a service account in a namespace
      --as-group stringArray       Group to impersonate for the operation, this flag can be repeated to specify multiple groups.
      --as-uid string              UID to impersonate for the operation.
      --context string             Kubernetes configuration context
      -i, --istioNamespace string  Istio system namespace (default "istio-system")
      --kubeclient-timeout string  Kubernetes client timeout as a time.Duration string, defaults to 15 seconds. (default "15s")
      -c, --kubeconfig string      Kubernetes configuration file
      -n, --namespace string       Kubernetes namespace
      --out string                 output directory (default "/tmp/istioctl-cli-docs/1.30")

istioctl bootstrap istioctl ecs add-service