Configuring Istio Ambient Mesh + Gateway API on EKS with Terraform

Istio Ambient Mesh is a new architecture that lets you build a service mesh without sidecars.
It is more efficient than the existing Istio architecture in that it reduces operational overhead and lets you introduce only the components you need, incrementally.

Kubernetes Gateway API is a networking standard that addresses shortcomings of the existing Ingress API and integrates naturally with Istio Ambient Mesh.

This post uses Terraform to install Istio Ambient Mesh and Gateway API on an Amazon EKS cluster and integrate them with an ALB to receive external traffic.

Installation Overview

Install the following components with Terraform.

Component	Description
`istio-base`	Installs common Istio resources (CRDs, etc.)
`gateway-api CRDs`	Gateway API resource definitions
`istiod (ambient)`	Control plane for Ambient Mesh
`istio-cni`	CNI for Ambient Mesh
`ztunnel`	Proxy that provides L4 tunneling
`gateway-api.yaml`	Gateway + HTTPRoute definitions and ALB integration with an ACM certificate

Istio Ambient Mesh와 Gateway API의 Terraform 리소스 관계

Line guide

Terraform depends_on 순서
Gateway 설정이 참조하거나 허용하는 대상

Istio Ambient Mesh와 Gateway API의 Terraform 리소스 관계

istio-base, Gateway API CRD, istiod, istio-cni, ztunnel 순서로 ambient 구성을 설치하고, CRD 위에 Gateway 리소스를 만든다. Gateway는 ACM 인증서를 주석으로 받고 shared-gateway-access 라벨이 있는 Namespace의 Route만 허용한다.

Read the diagram as text

Gateway API CRD는 istio-base에 의존한다.
istiod(profile ambient)는 istio-base와 Gateway API CRD에 의존한다.
istio-cni(profile ambient)는 istio-base, CRD, istiod에 의존한다.
ztunnel(L4 프록시)은 istio-base, CRD, istiod, istio-cni에 의존한다.
Gateway 리소스(gateway-api.yaml)는 Gateway API CRD에 의존한다.
Gateway는 ACM_CERT_ARN을 aws-load-balancer-ssl-cert 주석으로 받는다.
리스너 allowedRoutes는 shared-gateway-access: "true" 라벨이 있는 Namespace만 허용한다.

1. Install istio-base

This Helm chart provides the foundation for the Ambient Mesh installation.

hcl

resource "helm_release" "istio_base" {
  namespace        = "istio-system"
  create_namespace = true
  name             = "istio-base"
  repository       = "https://istio-release.storage.googleapis.com/charts"
  chart            = "base"
  upgrade_install  = true

  values = [
    yamlencode({
      defaultRevision = "default"
    })
  ]
}

2. Install the Gateway API CRDs

Gateway API can replace Ingress and is officially supported by Istio.

hcl

data "http" "gateway_api_crds" {
  url = "https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.1/standard-install.yaml"
}

data "kubectl_file_documents" "gateway_api_docs" {
  content = data.http.gateway_api_crds.response_body
}

resource "kubectl_manifest" "gateway_api_crds" {
  for_each  = data.kubectl_file_documents.gateway_api_docs.manifests
  yaml_body = each.value

  depends_on = [ helm_release.istio_base ]
}

3. Install istiod (Ambient Mode)

Use the profile = "ambient" option for Ambient Mesh without sidecars.

hcl

resource "helm_release" "istiod" {
  namespace        = "istio-system"
  create_namespace = true
  name             = "istiod"
  repository       = "https://istio-release.storage.googleapis.com/charts"
  chart            = "istiod"
  upgrade_install  = true

  values = [
    yamlencode({
      profile = "ambient"
    })
  ]

  depends_on = [ helm_release.istio_base, kubectl_manifest.gateway_api_crds ]
}

4. Install Istio CNI and ztunnel

ztunnel is a core component of Ambient Mesh that acts as an L4 proxy.

hcl

resource "helm_release" "istio_cni" {
  name             = "istio-cni"
  chart            = "cni"
  repository       = "https://istio-release.storage.googleapis.com/charts"
  namespace        = "istio-system"
  create_namespace = true
  upgrade_install  = true

  values = [
    yamlencode({
      profile = "ambient"
    })
  ]

  depends_on = [
    helm_release.istio_base,
    kubectl_manifest.gateway_api_crds,
    helm_release.istiod
  ]
}

resource "helm_release" "ztunnel" {
  name             = "ztunnel"
  chart            = "ztunnel"
  repository       = "https://istio-release.storage.googleapis.com/charts"
  namespace        = "istio-system"
  create_namespace = true
  upgrade_install  = true

  depends_on = [
    helm_release.istio_base,
    kubectl_manifest.gateway_api_crds,
    helm_release.istiod,
    helm_release.istio_cni
  ]
}

5. Install Gateway API Resources

Configure a Gateway accessible from outside through an ALB, using an ACM certificate.

hcl

resource "kubectl_manifest" "gateway" {
  yaml_body = templatefile("${path.module}/manifests/gateway-api.yaml", {
    ACM_CERT_ARN = data.aws_acm_certificate.cert.arn
  })

  depends_on = [
    kubectl_manifest.gateway_api_crds
  ]
}

The gateway-api.yaml above includes GatewayClass, Gateway, HTTPRoute, and other resources, configuring the ALB and traffic routing.

gateway-api.yaml

yaml

apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: gateway
  namespace: istio-system
  annotations:
    service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
    service.beta.kubernetes.io/aws-load-balancer-attributes: "load_balancing.cross_zone.enabled=true"
    service.beta.kubernetes.io/aws-load-balancer-ssl-cert: "${ACM_CERT_ARN}"
    service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "443"
spec:
  gatewayClassName: istio
  listeners:
  - name: http
    hostname: "*.dongdorrong.com"
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: Selector
        selector:
          matchLabels:
            shared-gateway-access: "true"
  - name: https
    hostname: "*.dongdorrong.com"
    port: 443
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: Selector
        selector:
          matchLabels:
            shared-gateway-access: "true"

Closing Notes

The configuration automated with Terraform includes the following.

Installation of all Istio Ambient Mesh components
Configuration of Gateway API CRDs and resources

You can then add the istio.io/dataplane-mode=ambient label to your service namespace and extend the setup to L7 control with a waypoint proxy, HTTPRoute, and other resources.