Istio in second-generation clusters

1. Review the system requirements of the add-on to make sure you have enough resources to install it.
2. (Optional) Perform manual scaling of worker node groups or set up automatic scaling.

Several installation options are available for Istio.

The full add-on settings code along with the description of the fields is available in the official Istio documentation.

The add-on has two operating modes available which define methods for intercepting and routing traffic between pods in the service mesh:

• default: In this mode, Istio uses the classic sidecar architecture. It adds an istio-proxy container to each pod, which intercepts, encrypts, and routes traffic. Pod-level traffic interception is done using iptables.
• ambient (default): In this mode, Istio operates at the node level of the cluster, without sidecar containers. Traffic is intercepted using eBPF at the core level. The intercepted packages are passed to the ztunnel component, which runs on each node of the cluster, for encryption and L4 routing. You can configure L7-level policies by additionally setting up waypoint proxies.

Mutual TLS (mTLS) encryption is used in both modes.

Depending on the mode, a set of components is installed in the service mesh. These components are specified in the spec.components block with the enabled: true value. For Istio to work in the ambient mode, it requires the base, pilot, cni, and ztunnel — they are already enabled, do not disable them. The rest of the components are optional. For more details on them, refer to the official Istio documentation.

If you want to use the default mode instead of ambient:

1. Set default in the spec.profile field:

    
   ...kind: IstioOperatorspec:  profile: default...

2. In the spec.components block, set:

   • For the base and pilot components: enabled: true.
   • For the ztunnel component: enabled: false.
   • The rest of the components are optional.

   Following is an example of an edited spec.components block:

    
   components:base: enabled: true k8s:   imagePullPolicy: "IfNotPresent"   tolerations: []   # - key: "Key"   #   operator: "Exists"   #   effect: "NoSchedule"pilot: enabled: true k8s:   replicaCount: 2   imagePullPolicy: "IfNotPresent"   tolerations: []   # - key: "Key"   #   operator: "Exists"   #   value: "Value"   #   effect: "NoSchedule"   nodeSelector: {}   resources:     requests:       cpu: 250m       memory: 512Miztunnel: enabled: false k8s:   imagePullPolicy: "IfNotPresent"   tolerations: []     # - key: "Key"     #   operator: "Exists"     #   value: "Value"     #   effect: "NoSchedule"   nodeSelector: {}   resources:     requests:       cpu: 250m       memory: 512Mi

Once finished editing the code, continue with the add-on installation.