DOCS-2798: Deploy Istio Ambient Mode on your cluster #2431
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
✅ Deploy Preview for calico-docs-preview-next ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
✅ Deploy Preview succeeded!Built without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify project configuration. |
ctauchen
force-pushed
the
docs-2798-istio
branch
from
5a151d3 to
8ddc9ed
Compare
ctauchen
force-pushed
the
docs-2798-istio
branch
from
8ddc9ed to
98dbe35
Compare
ctauchen
changed the title
ctauchen
changed the title
ctauchen
force-pushed
the
docs-2798-istio
branch
from
98dbe35 to
6073767
Compare
Collaborator
Author
calico-enterprise_versioned_docs/version-3.22-2/compliance/istio/deploy-istio-ambient.mdx
Show resolved
Hide resolved
radixo
suggested changes
Dec 17, 2025
Contributor
radixo
left a comment
radixo
left a comment
There was a problem hiding this comment.
Lovely material, just one waypoint concept to fix.
| This modification allows existing Calico and Kubernetes network policies to continue functioning exactly as they did before, without needing any rewrites, even though the traffic is now encrypted with mTLS. | ||
|
|
||
| These zTunnel enhancements are not compatible with Istio's application-layer Waypoint proxy. | ||
| If you deploy Waypoint, the reported destination ports will follow the original behavior (always port 15008), and you will need to modify existing network policies. |
Contributor
There was a problem hiding this comment.
Suggested change
| If you deploy Waypoint, the reported destination ports will follow the original behavior (always port 15008), and you will need to modify existing network policies. | |
| If you deploy Waypoint, the reported destination ports will follow the original behavior (always port 15008), and you will need to allow the traffic to/from waypoint with the destination port 15008. |
probably the way I suggested here is not the best, but the idea is. The network policies needs to have to include the port 15008 for traffic coming from the waypoint (L7 filtered only).
Collaborator
Author
There was a problem hiding this comment.
Thanks, I've changed the language here.
| * Istio Ambient Mode does not work together with [workload-based web application firewalls](../../threat/web-application-firewall.mdx). | ||
| * The service mesh is not supported for use on clusters that are also part of a [cluster mesh](../../multicluster/index.mdx). | ||
| * Destination ports are preserved only when Istio is deployed without Waypoint. | ||
| If you deploy Waypoint, all traffic in the mesh will show port 15008 as its destination port. |
Contributor
There was a problem hiding this comment.
Suggested change
| If you deploy Waypoint, all traffic in the mesh will show port 15008 as its destination port. | |
| If you deploy Waypoint, all traffic through waypoints will show port 15008 as its destination port. |
5 tasks
DOCS-2798
ctauchen
force-pushed
the
docs-2798-istio
branch
from
6073767 to
72aa35e
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Product Version(s):
Issue:
Link to docs preview:
https://deploy-preview-2431--tigera.netlify.app/calico-enterprise/3.22/compliance/istio/about-istio-ambient
SME review:
DOCS review:
Additional information:
Merge checklist: