Istio Ambient Mesh: Sidecar-Free Service Mesh Setup and Migration

# Install istioctl
curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.21.0 sh -
export PATH=$PWD/istio-1.21.0/bin:$PATH

# Install Istio with ambient profile
istioctl install --set profile=ambient --set "components.ingressGateways[0].enabled=true" -y

# Verify installation
kubectl get pods -n istio-system
# NAME                                    READY   STATUS
# istiod-xxx                              1/1     Running
# ztunnel-xxx (one per node)              1/1     Running
# istio-ingressgateway-xxx                1/1     Running

istioctl verify-install

# Label namespace to enable ambient mesh (no pod restarts needed!)
kubectl label namespace default istio.io/dataplane-mode=ambient

# Verify — pods should NOT have sidecar containers
kubectl get pods -n default
# NAME          READY   STATUS
# myapp-xxx     1/1     Running  ← only 1 container, no sidecar!

# Check ztunnel is handling traffic
kubectl logs -n istio-system -l app=ztunnel | grep "default"

# Verify mTLS is working
kubectl exec -it sleep-xxx -- curl http://httpbin:8000/headers
# X-Forwarded-Client-Cert header should appear, proving mTLS

# Check ztunnel metrics
kubectl exec -n istio-system ztunnel-xxx -- curl localhost:15020/metrics | grep ztunnel_

# Create a waypoint for a namespace
istioctl waypoint apply --namespace default

# Or for a specific service account
istioctl waypoint apply --namespace default --name reviews-waypoint \
    --for service

# Verify waypoint is running
kubectl get pods -n default -l gateway.istio.io/managed=istio.io-mesh-controller
# NAME                        READY   STATUS
# waypoint-xxx                1/1     Running

# Retry policy (requires waypoint)
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews
  namespace: default
spec:
  hosts:
  - reviews
  http:
  - route:
    - destination:
        host: reviews
    retries:
      attempts: 3
      perTryTimeout: 2s
      retryOn: 5xx,reset,connect-failure
    timeout: 10s

# Circuit breaker (requires waypoint)
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: reviews
spec:
  host: reviews
  trafficPolicy:
    outlierDetection:
      consecutive5xxErrors: 5
      interval: 30s
      baseEjectionTime: 30s

# Canary deployment: 90% v1, 10% v2
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews
spec:
  hosts:
  - reviews
  http:
  - route:
    - destination:
        host: reviews
        subset: v1
      weight: 90
    - destination:
        host: reviews
        subset: v2
      weight: 10

# Deny all traffic by default, then allow explicitly
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: deny-all
  namespace: default
spec: {}  # empty spec = deny all

---
# Allow frontend to call backend
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: default
spec:
  selector:
    matchLabels:
      app: backend
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/default/sa/frontend"]
    to:
    - operation:
        methods: ["GET", "POST"]
        paths: ["/api/*"]

# Require mTLS for all traffic in namespace
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: default
spec:
  mtls:
    mode: STRICT  # reject non-mTLS connections

# Step 1: Install ambient alongside existing sidecar mesh
istioctl install --set profile=ambient -y
# Existing sidecar pods continue working

# Step 2: Migrate one namespace at a time
kubectl label namespace staging istio.io/dataplane-mode=ambient

# Step 3: Remove sidecar injection from migrated namespace
kubectl label namespace staging istio-injection-

# Step 4: Restart pods to remove sidecars
kubectl rollout restart deployment -n staging

# Step 5: Verify traffic still works
kubectl exec -n staging sleep-xxx -- curl http://httpbin:8000/get

# Step 6: Repeat for other namespaces

# See which pods still have sidecars
kubectl get pods -A -o json | jq '.items[] | select(.spec.containers | length > 1) | .metadata.name'

# Check ambient enrollment
kubectl get pods -n default -o json | jq '.items[].metadata.annotations["ambient.istio.io/redirection"]'
# Should show "enabled" for ambient pods

# Measure sidecar overhead
kubectl top pods -n default --containers | grep istio-proxy
# istio-proxy containers typically use 50-100MB RAM each

# Measure ztunnel overhead
kubectl top pods -n istio-system -l app=ztunnel
# One ztunnel per node, typically 10-30MB RAM

# Calculate savings for 100 pods on 10 nodes:
# Sidecar: 100 × 75MB = 7,500MB
# Ambient: 10 × 20MB = 200MB
# Savings: ~7,300MB (97% reduction)

# L4 metrics from ztunnel (always available)
kubectl exec -n istio-system ztunnel-xxx -- curl -s localhost:15020/metrics | \
    grep -E "istio_tcp_connections|istio_tcp_sent_bytes"

# L7 metrics (requires waypoint)
kubectl exec -n default waypoint-xxx -- curl -s localhost:15020/metrics | \
    grep -E "istio_requests_total|istio_request_duration"

# Access logs
kubectl logs -n istio-system ztunnel-xxx | grep "default/myapp"

# Kiali dashboard (service topology)
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.21/samples/addons/kiali.yaml
istioctl dashboard kiali