For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Review additional configuration options for using kgateway as the ingress gateway in an Istio ambient mesh.

Review additional configuration options for using Solo Enterprise for kgateway as the ingress gateway in an Istio ambient mesh.

Cluster draining weights

Solo Enterprise for kgateway honors the solo.io/draining-weight annotation on east-west and remote peering gateways when routing ingress traffic to a multicluster ambient mesh. Previously, the draining weight was respected by ztunnel and waypoints for east-west traffic, but Solo Enterprise for kgateway continued to send ingress traffic to a draining cluster, resulting in connection errors.

When a remote cluster’s east-west gateway is annotated with solo.io/draining-weight, Solo Enterprise for kgateway adjusts the Envoy load balancing weights for that cluster’s endpoints on the ingress path:

Exclude ServiceEntries from discovery

You can exclude specific Istio ServiceEntry resources from the gateway’s backend and endpoint discovery by using Kubernetes label selectors. To enable this feature, set the serviceEntriesExclusionLabelSelectors Helm value to a list of selectors. Any ServiceEntry that matches a selector is ignored during the backend and endpoint discovery phase.

A ServiceEntry is excluded if it matches any entry in the list (OR condition). Within each entry, all matchLabels and matchExpressions conditions must hold for the ServiceEntry to be excluded (AND condition). Empty entries are rejected to prevent excluding all ServiceEntries.

The following example shows multiple matchLabel entries. ServiceEntries are excluded if they have both example.io/source: generated and example.io/source-kind: ExternalService labels (AND condition), or the env: staging label (OR condition).

serviceEntriesExclusionLabelSelectors:
  # Exclude entries that have both labels (AND within an entry)
  - matchLabels:
      example.io/source: generated
      example.io/source-kind: ExternalService
  # Also exclude entries in staging (OR across entries)
  - matchLabels:
      env: staging

Use kgateway with PeerAuthentication strict mode

The gateway proxy must be enrolled in the ambient mesh so that its outbound connections to backend services are captured by ztunnel and participate in mesh policy enforcement. A consequence of this enrollment is that ztunnel also captures inbound connections to the gateway pod. With a PeerAuthentication policy set to mtls.mode: STRICT, ztunnel requires mTLS on every connection it handles. Because external clients do not have mesh identities, their inbound connections are rejected with this error message:

connection closed due to policy rejection: explicitly denied by: istio-system/istio_converted_static_strict

The intended behavior for an ingress gateway is for inbound external traffic to bypass ztunnel entirely. The ambient.istio.io/bypass-inbound-capture: "true" annotation configures this explicitly, so that ztunnel captures only outbound connections from the gateway to backend services.

To allow inbound external connections while keeping outbound traffic in the mesh, add the ambient.istio.io/bypass-inbound-capture: "true" annotation to the kgateway pod in an EnterpriseKgatewayParameters resource.

kubectl apply -f - <<EOF
apiVersion: enterprisekgateway.solo.io/v1alpha1
kind: EnterpriseKgatewayParameters
metadata:
  name: <params-name>
  namespace: <gateway-namespace>
spec:
  kube:
    podTemplate:
      extraAnnotations:
        ambient.istio.io/bypass-inbound-capture: "true"
EOF

Your Gateway resource must reference the EnterpriseKgatewayParameters resource so that the annotation applies to the gateway pod. For an example of how to reference an EnterpriseKgatewayParameters resource from a Gateway, see Customize the gateway proxy.