Skip to content

Istio Egress Gateway

This package deploys a centralized egress waypoint for Big Bang clusters running Istio in ambient mode. It is a small, first-party chart: it renders a Gateway API Gateway, a waypoint configuration ConfigMap, and a default-deny AuthorizationPolicy. The waypoint proxy pods themselves are created and managed by istiod from the Gateway resource — this chart deploys no workloads of its own.

What gets deployed

Resource Purpose
Gateway (gatewayClassName: istio-waypoint) The egress waypoint. One HBONE listener on 15008 with allowedRoutes: All so ServiceEntries in other namespaces can bind to it.
ConfigMap (referenced via infrastructure.parametersRef) Sizing for the istiod-generated waypoint Deployment (resources, and optionally HPA/PDB) as strategic-merge patches.
AuthorizationPolicy Default-deny baseline: an ALLOW policy with no rules, attached to the Gateway via targetRefs, denies everything not admitted by a route-attached ALLOW policy.

Request flow

app pod ──> ztunnel (HBONE :15008) ──> egress waypoint ──> external host

Traffic only takes this path when a ServiceEntry for the destination is bound to the waypoint with the istio.io/use-waypoint and istio.io/use-waypoint-namespace labels. In Big Bang those bindings come from bb-common — see below.

The bb-common side

This chart only ships the waypoint itself. The per-package resources that send traffic through it are generated by bb-common from each package’s routes.outbound values. For every waypoint-bound outbound route, bb-common renders in the package namespace:

  • ServiceEntry waypoint labels (istio.io/use-waypoint, istio.io/use-waypoint-namespace) so ztunnel forwards the route’s traffic through the waypoint.
  • AuthorizationPolicy (<service-entry-name>-egress) admitting the route’s traffic at the waypoint — this is what punches through the default-deny baseline deployed by this chart.
  • NetworkPolicy (allow-egress-to-<waypoint-namespace>-<waypoint-name>) allowing HBONE egress (port 15008) to the waypoint pods.

The waypoint reference (<namespace>/<name>, e.g. istio-egress/egress-waypoint) is set per route via egressGateway, or for a whole package via routes.defaults.outbound.egressGateway; the Big Bang umbrella sets that default only when ambient mode is enabled. See Egress Gateway (Waypoint) Binding in the bb-common docs for the full contract, including per-route opt-out (egressGateway: false).

bb-common expects the waypoint’s HBONE listener to allow cross-namespace routes — this chart satisfies that with its waypoint.listeners.allowedRoutesNamespacesFrom: All default.

Important caveats

  • The waypoint only governs traffic that reaches it. Ambient mode has no REGISTRY_ONLY backstop, so package NetworkPolicies must stay restrictive — a broad 443 → 0.0.0.0/0 egress rule bypasses the waypoint entirely.
  • Traffic is L4/HTTPS-passthrough by default, which limits L7 policy expressiveness at the waypoint.
  • The waypoint is a shared fate domain. All bound egress traffic flows through it; size it per deployment via waypoint.config (resources, HPA, PDB).
  • Bind only when the waypoint exists. Istio fails open while a bound waypoint is not programmed — a labeled ServiceEntry with no waypoint sends traffic directly out. Only set egressGateway references on routes after this package is deployed.

Bring your own waypoint

Instead of deploying this package, point routes.defaults.outbound.egressGateway (or a package’s per-route egressGateway) at an existing waypoint (<namespace>/<name>) to use one managed outside of Big Bang.