Istio Configuration (bb-common)¶
Alloy delegates mesh resources to bb-common; it does not maintain a separate
Istio configuration API. Use the library’s
Istio reference
and network-policy reference
for shared configuration and examples. These links match the dependency in
Chart.lock; select the matching ref for another version.
Prerequisites¶
Package mesh settings belong under istio, not upstream.istio. In the umbrella,
pass package overrides through the values mapping described in the
overview. Use current istio.* settings
rather than the deprecated istio.hardened.* paths.
The package’s Istio template renders only
when istio.enabled is true. Rendering resources does not enroll collectors in
the mesh: the umbrella manages namespace enrollment and dataplane rollouts.
Sidecar (Outbound Traffic Policy)¶
The umbrella configures sidecar certificate mounts and HTTPS for metrics remote write. Ambient mode uses different transport handling; do not copy sidecar-only certificate or injection settings into an ambient deployment. The umbrella values mapping owns this wiring; select the Big Bang release used by your environment.
The library’s Sidecar reference explains outbound policy controls and why Sidecar resources do not apply in ambient mode.
ServiceEntries¶
Adding an Alloy destination does not grant it network access. Review the collector egress rules and mesh registration for every additional host and port. Use the library’s outbound routes or custom ServiceEntries reference rather than copying a generic example. Keep destination credentials in protected Secrets or encrypted deployment values.
Authorization Policies¶
Alloy’s ingress rules distinguish Prometheus scrapes, collector-to-collector scrapes, and trace receivers. Preserve the collector selectors, service-account identities, and ports when overriding them. Shared generation and customization are documented in the library’s authorization-policy reference.
PeerAuthentication¶
The package defaults to istio.mtls.mode: STRICT when Istio resources are enabled.
Use the library’s PeerAuthentication reference
for configuration; coordinate changes with collector and Prometheus scrape TLS.