istio

1
# The ambient profile enables ambient mode. The Istiod, CNI, and ztunnel charts must be deployed
2
meshConfig:
3
  defaultConfig:
4
    proxyMetadata:
5
      ISTIO_META_ENABLE_HBONE: "true"
6
variant: distroless
7
pilot:
8
  variant: distroless
9
  env:
10
    # Setup more secure default that is off in 'default' only for backwards compatibility
11
    VERIFY_CERTIFICATE_AT_CLIENT: "true"
12
    ENABLE_AUTO_SNI: "true"
13

14
    PILOT_ENABLE_HBONE: "true"
15
    CA_TRUSTED_NODE_ACCOUNTS: "istio-system/ztunnel,kube-system/ztunnel"
16
    PILOT_ENABLE_AMBIENT_CONTROLLERS: "true"
17
    PILOT_ENABLE_AMBIENT_WAYPOINTS: "true"
18
cni:
19
  logLevel: info
20
  ambient:
21
    enabled: true
22

23
  # Default excludes istio-system; its actually fine to redirect there since we opt-out istiod, ztunnel, and istio-cni
24
  excludeNamespaces:
25
    - kube-system
26