Deep Dive into Istio Ambient Mode Traffic Paths: The Powerful Combination of eBPF and Istio

# Set environment variables
export PROJECT_ID="your-project-id"
export CLUSTER_NAME="istio-ambient-cluster"
export REGION="us-central1"

# Create cluster
gcloud container clusters create $CLUSTER_NAME \
    --project=$PROJECT_ID \
    --zone=$REGION-a \
    --machine-type=e2-standard-4 \
    --num-nodes=3 \
    --enable-dataplane-v2 \
    --enable-ip-alias \
    --release-channel=rapid \
    --workload-pool=$PROJECT_ID.svc.id.goog

# Get cluster credentials
gcloud container clusters get-credentials $CLUSTER_NAME \
    --zone=$REGION-a \
    --project=$PROJECT_ID

# Core configuration of netd DaemonSet
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: netd
  namespace: kube-system
  annotations:
    components.gke.io/layer: addon
spec:
  template:
    spec:
      hostNetwork: true
      containers:
      - name: install-cni
        # Initialize CNI configuration
      - name: netd
        # Manage data plane and routing
      - name: netd-metrics-collector
        # Collect network metrics

# Create namespace
kubectl create namespace istio-system

# Create resource quota
kubectl apply -f - <<EOF
apiVersion: v1
kind: ResourceQuota
metadata:
  name: gcp-critical-pods
  namespace: istio-system
spec:
  hard:
    pods: 1000
    requests.cpu: "10"
    requests.memory: 20Gi
    limits.cpu: "20"
    limits.memory: 40Gi
  scopeSelector:
    matchExpressions:
    - operator: In
      scopeName: PriorityClass
      values:
      - system-node-critical
EOF

# Check and install Gateway API CRDs
if ! kubectl get crd gateways.gateway.networking.k8s.io &> /dev/null; then
    echo "Installing Gateway API CRDs..."
    kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.2.0/standard-install.yaml
    
    # Wait for CRDs to be ready
    kubectl wait --for condition=established --timeout=60s crd/gateways.gateway.networking.k8s.io
fi

# Add Istio Helm repository
helm repo add istio https://istio-release.storage.googleapis.com/charts
helm repo update

# 1. Install base components
echo "Installing Istio base components..."
helm install istio-base istio/base \
    -n istio-system \
    --create-namespace \
    --wait \
    --timeout=10m

# 2. Install control plane
echo "Installing Istio control plane..."
helm install istiod istio/istiod \
    --namespace istio-system \
    --set profile=ambient \
    --set pilot.env.PILOT_ENABLE_AMBIENT_CONTROLLERS=true \
    --wait \
    --timeout=10m

# 3. Install CNI component
echo "Installing Istio CNI..."
helm install istio-cni istio/cni \
    -n istio-system \
    --set profile=ambient \
    --set cni.ambient.enabled=true \
    --set cni.ambient.redirectMode=ebpf \
    --wait \
    --timeout=10m

# 4. Install ztunnel
echo "Installing ztunnel..."
helm install ztunnel istio/ztunnel \
    -n istio-system \
    --set resources.requests.cpu=100m \
    --set resources.requests.memory=128Mi \
    --set resources.limits.cpu=1000m \
    --set resources.limits.memory=1Gi \
    --wait \
    --timeout=10m

# 5. Install ingress gateway
echo "Installing ingress gateway..."
helm install istio-ingress istio/gateway \
    -n istio-ingress \
    --create-namespace \
    --set service.type=LoadBalancer \
    --wait \
    --timeout=10m

# Check all component status
echo "Checking Istio component status..."
kubectl get pods -n istio-system
kubectl get pods -n istio-ingress

# Verify ztunnel running status
echo "Verifying ztunnel status..."
kubectl get daemonset ztunnel -n istio-system

# Check CNI configuration
echo "Checking CNI configuration..."
kubectl get pods -n istio-system -l app=istio-cni-node

# Enable ambient mode for default namespace
kubectl label namespace default istio.io/dataplane-mode=ambient

# Verify label
kubectl get namespace default --show-labels

# Deploy namespace-level waypoint
istioctl waypoint apply -n default --enroll-namespace

# Check waypoint status
istioctl waypoint status -n default

# Deploy application
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.23/samples/bookinfo/platform/kube/bookinfo.yaml

# Wait for Pods to be ready
kubectl wait --for=condition=ready pod --all -n default --timeout=300s

# Deploy service versions
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.23/samples/bookinfo/platform/kube/bookinfo-versions.yaml

# Verify deployment
kubectl get pods,svc -n default

kubectl apply -f - <<EOF
# Gateway configuration
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: bookinfo-gateway
  namespace: default
spec:
  gatewayClassName: istio
  listeners:
  - name: http
    port: 80
    protocol: HTTP
    allowedRoutes:
      namespaces:
        from: Same
---
# HTTPRoute configuration
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: bookinfo
  namespace: default
spec:
  parentRefs:
  - name: bookinfo-gateway
  rules:
  - matches:
    - path:
        type: Exact
        value: /productpage
    - path:
        type: PathPrefix
        value: /static
    - path:
        type: Exact
        value: /login
    - path:
        type: Exact
        value: /logout
    - path:
        type: PathPrefix
        value: /api/v1/products
    backendRefs:
    - name: productpage
      port: 9080
      weight: 100
---
# Reviews service routing (to v1 version)
apiVersion: gateway.networking.k8s.io/v1beta1
kind: HTTPRoute
metadata:
  name: reviews
  namespace: default
spec:
  parentRefs:
  - group: ""
    kind: Service
    name: reviews
    port: 9080
  rules:
  - backendRefs:
    - name: reviews-v1
      port: 9080
      weight: 100
EOF

# Get gateway address
export GATEWAY_URL=$(kubectl -n default get service bookinfo-gateway-istio -o jsonpath='{.status.loadBalancer.ingress[0].ip}')

# Wait for load balancer to be ready
echo "Waiting for load balancer IP assignment..."
while [ -z "$GATEWAY_URL" ] || [ "$GATEWAY_URL" == "null" ]; do
    sleep 10
    GATEWAY_URL=$(kubectl -n default get service bookinfo-gateway-istio -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
    echo "Current status: $GATEWAY_URL"
done

echo "Gateway address: http://$GATEWAY_URL"

# Test access
curl -I http://$GATEWAY_URL/productpage

# Continuous test script
cat > test-traffic.sh <<EOF
#!/bin/bash
GATEWAY_URL=$GATEWAY_URL
echo "Starting test traffic to: http://\$GATEWAY_URL/productpage"
while true; do
    response=\$(curl -s -o /dev/null -w "%{http_code}" http://\$GATEWAY_URL/productpage)
    echo "\$(date): HTTP \$response"
    sleep 2
done
EOF

chmod +x test-traffic.sh
./test-traffic.sh

// Simplified eBPF program logic
SEC("tc")
int traffic_interceptor(struct __sk_buff *skb) {
    // Parse packet headers
    struct ethhdr *eth = bpf_hdr_pointer(skb, 0, sizeof(*eth), &eth_buffer);
    
    // Check if this is target traffic
    if (is_istio_managed_traffic(skb)) {
        // Redirect to ztunnel
        return bpf_redirect(ZTUNNEL_IFINDEX, 0);
    }
    
    // Normal forwarding
    return TC_ACT_OK;
}

# View ztunnel-created iptables rules
kubectl exec -n istio-system ds/ztunnel -c istio-proxy -- \
    iptables -t nat -L ISTIO_OUTPUT -v -n

# Typical rule examples
# -A ISTIO_OUTPUT -o lo -s 127.0.0.6/32 -j RETURN
# -A ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -j REDIRECT --to-ports 15001
# -A ISTIO_OUTPUT -p tcp --dport 15008 -j REDIRECT --to-ports 15008

# Example Waypoint routing configuration
apiVersion: v1
kind: ConfigMap
metadata:
  name: waypoint-envoy-config
data:
  envoy.yaml: |
    static_resources:
      listeners:
      - name: inbound
        address:
          socket_address:
            address: 0.0.0.0
            port_value: 15008
        filter_chains:
        - filters:
          - name: envoy.filters.network.http_connection_manager
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
              route_config:
                virtual_hosts:
                - name: reviews
                  domains: ["reviews.default.svc.cluster.local"]
                  routes:
                  - match:
                      prefix: "/"
                    route:
                      cluster: reviews-v1
                      # Advanced routing features
                      retry_policy:
                        retry_on: "5xx"
                        num_retries: 3
                      timeout: 30s

# ztunnel performance optimization configuration
apiVersion: v1
kind: ConfigMap
metadata:
  name: ztunnel-config
  namespace: istio-system
data:
  config.yaml: |
    # Enable eBPF redirection mode
    redirect_mode: ebpf
    
    # Adjust connection pool size
    connection_pool:
      tcp:
        max_connections: 1000
        connect_timeout: 10s
        tcp_keepalive:
          time: 7200
          interval: 75
          probes: 9
    
    # Optimize DNS resolution
    dns:
      refresh_rate: 30s
      search_suffixes:
      - "default.svc.cluster.local"
      - "svc.cluster.local"
      - "cluster.local"

# Waypoint horizontal scaling configuration
apiVersion: gateway.networking.k8s.io/v1beta1
kind: Gateway
metadata:
  name: waypoint
  namespace: default
  annotations:
    gateway.istio.io/service-account: waypoint
spec:
  gatewayClassName: istio-waypoint
  infrastructure:
    annotations:
      # Scalability configuration
      autoscaling.istio.io/enabled: "true"
      autoscaling.istio.io/min-replicas: "2"
      autoscaling.istio.io/max-replicas: "10"
      autoscaling.istio.io/target-cpu-utilization: "70"

# Fine-grained network policy
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: reviews-policy
  namespace: default
spec:
  selector:
    matchLabels:
      app: reviews
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/default/sa/productpage"]
    to:
    - operation:
        methods: ["GET"]
        paths: ["/reviews/*"]
  - when:
    - key: source.ip
      values: ["10.0.0.0/8"]  # Only allow internal cluster traffic

# Deploy Hubble UI
kubectl apply -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hubble-ui
  namespace: gke-managed-dpv2-observability
spec:
  replicas: 1
  selector:
    matchLabels:
      app: hubble-ui
  template:
    metadata:
      labels:
        app: hubble-ui
    spec:
      containers:
      - name: frontend
        image: quay.io/cilium/hubble-ui:v0.12.1
        ports:
        - containerPort: 8081
        env:
        - name: EVENTS_SERVER_PORT
          value: "8090"
        - name: FLOWS_API_ADDR
          value: "hubble-relay:80"
      - name: backend
        image: quay.io/cilium/hubble-ui-backend:v0.12.1
        ports:
        - containerPort: 8090
        env:
        - name: EVENTS_SERVER_PORT
          value: "8090"
        - name: FLOWS_API_ADDR
          value: "hubble-relay:80"
---
apiVersion: v1
kind: Service
metadata:
  name: hubble-ui
  namespace: gke-managed-dpv2-observability
spec:
  selector:
    app: hubble-ui
  ports:
  - port: 80
    targetPort: 8081
    protocol: TCP
EOF

# Port forwarding access
kubectl -n gke-managed-dpv2-observability port-forward service/hubble-ui 16100:80 --address='0.0.0.0'

# Istio monitoring configuration
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: control-plane
spec:
  values:
    telemetry:
      v2:
        prometheus:
          configOverride:
            metric_relabeling_configs:
            - source_labels: [__name__]
              regex: 'istio_.*'
              target_label: __name__
              replacement: '${1}'
            inbound_metric_relabeling_configs:
            - source_labels: [__name__]
              regex: 'istio_request_duration_milliseconds'
              target_label: __name__
              replacement: 'istio_request_duration_ms'

# Install Kiali and its dependencies
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.23/samples/addons/prometheus.yaml
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.23/samples/addons/kiali.yaml

# Wait for deployment to complete
kubectl wait --for=condition=available --timeout=600s deployment/kiali -n istio-system

# Access Kiali dashboard
istioctl dashboard kiali --address 0.0.0.0

# Custom Telemetry configuration
apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: ambient-metrics
  namespace: istio-system
spec:
  metrics:
  - providers:
    - name: prometheus
  - overrides:
    - match:
        metric: requests_total
      tagOverrides:
        ambient_mode:
          value: "true"
    - match:
        metric: request_duration_milliseconds
      tagOverrides:
        proxy_type:
          value: |
            has(source.workload.name) ? 
            (source.workload.name | startsWith("ztunnel") ? "ztunnel" : 
             source.workload.name | startsWith("waypoint") ? "waypoint" : "unknown") : "unknown"

# Check namespace labels
kubectl get namespace default --show-labels

# Check ztunnel logs
kubectl logs -n istio-system -l app=ztunnel --tail=100

# Check CNI plugin status
kubectl get pods -n istio-system -l app=istio-cni-node

# Verify eBPF program loading
kubectl exec -n istio-system ds/ztunnel -c istio-proxy -- \
    bpftool prog list | grep istio

# Re-label namespace
kubectl label namespace default istio.io/dataplane-mode=ambient --overwrite

# Restart related Pods
kubectl rollout restart deployment -n default

# Check waypoint status
istioctl waypoint status -n default

# View waypoint logs
kubectl logs -n default -l gateway.networking.k8s.io/gateway-name=waypoint

# Check Gateway resources
kubectl get gateway,httproute -n default -o yaml

# Redeploy waypoint
istioctl waypoint delete -n default
istioctl waypoint apply -n default --enroll-namespace

# Verify Gateway API configuration
kubectl describe gateway waypoint -n default

# Monitor ztunnel CPU usage
kubectl top pods -n istio-system -l app=ztunnel

# Check connection count statistics
kubectl exec -n istio-system ds/ztunnel -c istio-proxy -- \
    ss -tuln | wc -l

# Adjust resource limits
kubectl patch daemonset ztunnel -n istio-system --patch='
spec:
  template:
    spec:
      containers:
      - name: istio-proxy
        resources:
          limits:
            cpu: 2000m
            memory: 2Gi
          requests:
            cpu: 500m
            memory: 512Mi'

# Test end-to-end latency
kubectl exec -it deployment/productpage -c productpage -- \
    time curl -s reviews:9080/reviews/1

# Check eBPF program performance
kubectl exec -n istio-system ds/ztunnel -c istio-proxy -- \
    bpftool prog show pinned /sys/fs/bpf/tc/globals/istio_redir

# Optimize eBPF redirection
kubectl patch configmap ztunnel-config -n istio-system --patch='
data:
  config.yaml: |
    redirect_mode: ebpf
    performance:
      bypass_local_traffic: true
      optimize_for_latency: true'

apiVersion: v1
kind: Pod
metadata:
  name: debug-tools
  namespace: default
spec:
  containers:
  - name: debug
    image: nicolaka/netshoot:latest
    command: ["/bin/bash"]
    args: ["-c", "sleep 3600"]
    securityContext:
      capabilities:
        add: ["NET_ADMIN"]
  nodeSelector:
    kubernetes.io/os: linux

# Enter debug Pod
kubectl exec -it debug-tools -- bash

# Execute in debug Pod
# 1. Network connectivity test
curl -I productpage:9080/productpage

# 2. DNS resolution test
nslookup reviews.default.svc.cluster.local

# 3. Network path tracing
traceroute productpage.default.svc.cluster.local

# 4. Port scanning
nmap -p 9080 reviews.default.svc.cluster.local

# 5. Packet capture analysis
tcpdump -i any -w /tmp/traffic.pcap host reviews.default.svc.cluster.local

# Verify mTLS status
istioctl authn tls-check productpage.default.svc.cluster.local

# Check certificate validity
kubectl exec -n istio-system ds/ztunnel -c istio-proxy -- \
    openssl x509 -in /var/run/secrets/istio/cert-chain.pem -text -noout

# Strict network policy
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: default
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-ambient-traffic
  namespace: default
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: istio-system
  - from: []
    ports:
    - protocol: TCP
      port: 9080
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: istio-system
  - to: []
    ports:
    - protocol: TCP
      port: 9080
    - protocol: UDP
      port: 53

# Waypoint service account permission restriction
apiVersion: v1
kind: ServiceAccount
metadata:
  name: waypoint
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: waypoint-role
  namespace: default
rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list"]
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: waypoint-binding
  namespace: default
subjects:
- kind: ServiceAccount
  name: waypoint
  namespace: default
roleRef:
  kind: Role
  name: waypoint-role
  apiGroup: rbac.authorization.k8s.io

# istiod high availability deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: istiod
  namespace: istio-system
spec:
  replicas: 3
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 1
  template:
    spec:
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchLabels:
                app: istiod
            topologyKey: kubernetes.io/hostname
      topologySpreadConstraints:
      - maxSkew: 1
        topologyKey: topology.kubernetes.io/zone
        whenUnsatisfiable: DoNotSchedule
        labelSelector:
          matchLabels:
            app: istiod

# Prometheus alerting rules
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: istio-ambient-alerts
  namespace: istio-system
spec:
  groups:
  - name: istio.ambient
    rules:
    - alert: ZtunnelHighCPU
      expr: rate(container_cpu_usage_seconds_total{container="istio-proxy",pod=~"ztunnel-.*"}[5m]) > 0.8
      for: 5m
      labels:
        severity: warning
      annotations:
        summary: "ztunnel CPU usage is high"
        description: "ztunnel on {{ $labels.node }} has high CPU usage: {{ $value }}"
    
    - alert: WaypointDown
      expr: up{job="kubernetes-pods",pod=~"waypoint-.*"} == 0
      for: 1m
      labels:
        severity: critical
      annotations:
        summary: "Waypoint proxy is down"
        description: "Waypoint proxy in namespace {{ $labels.namespace }} is not responding"
    
    - alert: HighErrorRate
      expr: rate(istio_requests_total{response_code!~"2.."}[5m]) / rate(istio_requests_total[5m]) > 0.1
      for: 5m
      labels:
        severity: warning
      annotations:
        summary: "High error rate detected"
        description: "Error rate is {{ $value | humanizePercentage }} for {{ $labels.destination_service_name }}"