feat: add ztunnel cni for ambient #1142
Conversation
| @@ -0,0 +1,10345 @@ | |||
| # Copyright 2024 The Kubernetes Authors. | |||
There was a problem hiding this comment.
Could we install these CRDs as a manifest in the zarf.yaml with a remote reference instead of copying them in here? May make it easier to maintain across upgrades.
There was a problem hiding this comment.
Good idea, what will happen if the CRs are already installed in the cluster though? How can we deal with that? Or just assume that it won't be?
There was a problem hiding this comment.
Good q - I think in general it wouldn't be a problem to "re-apply" the CRDs via zarf manifest, but it could cause issues with helm ownership metadata on the CRDs. We could use zarf actions to add metadata (labels/annotations) to the existing CRDs if they exist, or just ignore it and assume they won't already be present on the cluster. Since the gateway CRDs are not a standard part of k8s clusters I think we might be okay to just assume that they aren't already present in the cluster?
There was a problem hiding this comment.
That was my first thought as well but I wonder if they might come in to some later flavor of k8s as a built in. I don't think we'll run into any clusters that are using these in the wild though so we should be safe to assume they don't exist
| mtls: | ||
| mode: STRICT | ||
| mode: PERMISSIVE |
There was a problem hiding this comment.
I missed this change earlier - what is the behavior with this set to STRICT? The way this behaves it would allow PERMISSIVE on all ports for the controller, I'd hope we could instead just set some ports to PERMISSIVE such as the two below here.
Description
This PR enables Istio Ambient for all of UDS Core. This includes Waypoint for L7 routing. It's still in draft until the FIPS discussion around ztunnel images and until the CNI ipset fix is released
Related Issue
Fixes #
Relates to #
Type of change
Steps to Validate
Checklist before merging