System and app requirements

If you use EKS with all of the following conditions, you must set POD_SECURITY_GROUP_ENFORCING_MODE to standard:

• Amazon’s VPC CNI
• Pod ENI trunking enabled
• EKS pod-attached SecurityGroups via SecurityGroupPolicy

Istio uses a link-local SNAT address to identify kubelet health probes. In strict enforcing mode, the VPC CNI does not exempt link-local addresses from policy enforcement, which causes pod health probes to fail.

For more information, see the Istio documentation.

On GKE, you must set global.platform=gke in your Helm installation commands, because GKE uses nonstandard locations for CNI binaries.

GKE also requires a ResourceQuota in any namespace where components with the system-node-critical priority class run. When installing in the default istio-system namespace, the ambient profile creates this automatically. If you install Istio into a different namespace, you must create the ResourceQuota manually.

apiVersion: v1
kind: ResourceQuota
metadata:
  name: gcp-critical-pods
  namespace: istio-system
spec:
  hard:
    pods: 1000
  scopeSelector:
    matchExpressions:
    - operator: In
      scopeName: PriorityClass
      values:
      - system-node-critical

For more information, see the Istio documentation.

On OpenShift, istio-cni and ztunnel must both be installed in the kube-system namespace, and all Helm installation commands must include --set global.platform=openshift.

If your workloads use liveness or readiness probes (which most do), you must also set routingViaHost: true in the Cluster Network Operator to enable OVN-Kubernetes local gateway mode. This ensures probe traffic is routed through the host network namespace, where the Istio CNI’s iptables rules apply. Without this, probe packets bypass the host netfilter stack via OVS and fail to reach the pod.

By default, kubelet and Kubernetes nodes do not have their own cryptographic identity. Ambient mesh uses a combination of iptables rules and SNAT to rewrite packets from the local node with a fixed link-local IP, so that Istio does not categorize kubelet traffic as insecure. For more information, see Considerations for Kubernetes network policy.

For more information, see the Istio documentation.

If you use Cilium as your CNI, review the following requirements:

• Cilium defaults to proactively deleting other CNI plugins and their configuration. You must set cni.exclusive = false to support chaining with the Istio CNI. For more information, see the Cilium documentation.

• Cilium’s BPF masquerading is disabled by default and is not currently supported with Istio ambient. Enabling it via bpf.masquerade=true results in non-functional pod health checks. The default iptables masquerading implementation works correctly.

• If you apply a default-deny NetworkPolicy or CiliumNetworkPolicy in your cluster, kubelet health probes will be blocked. Istio uses a link-local SNAT address for kubelet health probes that Cilium does not exempt from policy enforcement. To resolve this, apply the following CiliumClusterwideNetworkPolicy:

  apiVersion: "cilium.io/v2"
  kind: CiliumClusterwideNetworkPolicy
  metadata:
    name: "allow-ambient-hostprobes"
  spec:
    description: "Allows SNAT-ed kubelet health check probes into ambient pods"
    enableDefaultDeny:
      egress: false
      ingress: false
    endpointSelector: {}
    ingress:
    - fromCIDR:
      - "169.254.7.127/32"

  This policy is not required unless you have default-deny NetworkPolicies or CiliumNetworkPolicies in your cluster. For more information, see issue #49277 and the CiliumClusterwideNetworkPolicy documentation.