Istio CNI¶

Istio CNI installs the upstream Istio CNI node agent through a thin Big Bang passthrough chart. The agent configures pod traffic interception without an istio-init container in each workload. Big Bang supplies the Iron Bank image, image pull settings, and the ambient-mode value passed to the upstream chart.

For CNI architecture, platform requirements, and operational behavior, see the Istio CNI documentation.

Big Bang integration¶

Configure the package with the canonical packages.istioCNI entry. The legacy istioCNI entry remains supported for existing configurations. At the pinned umbrella snapshot, Big Bang installs the istio-cni release into kube-system.

packages:
  istioCNI:
    enabled: true

The umbrella owns source selection, Flux reconciliation, release wiring, dependency ordering, post-renderers, and the effective ambient-mode decision. It requires Istiod when it renders Istio CNI. In ordinary sidecar deployments, enable Istio CNI when the cluster should use CNI-based interception. When ambient mode is effective, Big Bang renders Istio CNI and passes the effective ambient setting to the chart; do not try to reproduce that orchestration with package-local values.

Configuration¶

Big Bang-specific values belong under packages.istioCNI.values. They are passed to this chart, whose upstream chart values are nested under upstream:

packages:
  istioCNI:
    enabled: true
    values:
      upstream:
        # Upstream Istio CNI settings for this deployment.
        global:
          logging:
            level: info

The wrapper already selects the Big Bang image and supplies global pull-policy, pull-secret, and ambient defaults. Use the version-matched upstream Istio 1.31.1 CNI values for the complete upstream configuration surface, including CNI configuration locations, chaining/provider settings, repair behavior, ambient selectors, and ambient DNS or IPv6 controls. Do not copy the upstream values table into Big Bang configuration.

Node access and operations¶

The upstream chart deploys a node-level DaemonSet. It writes CNI configuration and plugin data on nodes and uses privileged, host-networked containers with host-path mounts; optional repair actions can also require broad Pod access. Review those privileges, node operating-system compatibility, and any CNI provider-specific settings before enabling the package in a production cluster.

CNI availability affects new workload networking and can affect pods while the DaemonSet rolls. Validate sidecar and ambient changes in a disposable, representative cluster before changing production settings. For package upgrades, keep the wrapper version, locked upstream chart, image metadata, and upstream.global.tag aligned; coordinate a release and the umbrella source pin with the rest of the Istio stack.

Validation¶

The repository’s focused read-only check is:

helm lint chart

The package test selections cover sidecar and ambient scenarios, but chart lint does not prove node-level CNI behavior. Use the Big Bang package branch workflow for coupled Istio or ambient changes and validate the selected CNI provider on a disposable cluster.