Skip to content

Istio Gateway

This package deploys the Big Bang wrapper around Istio’s gateway chart. It provides the gateway workload and its Big Bang-owned resources; the umbrella chart owns gateway instances, TLS material, package selection, and Flux reconciliation.

Big Bang integration

Enable Istio Gateway through the canonical packages.istioGateway package configuration. The legacy top-level istioGateway path remains supported for compatibility. In either form, configuration belongs below values:

packageConfiguration:
  version: v1

packages:
  istioGateway:
    enabled: true
    values:
      shared:
        waitJob:
          enabled: false

The umbrella creates one Helm release for each enabled gateway in the istio-gateway namespace. It applies values in this order: common values, umbrella defaults, then your overlays. Values under shared apply to every gateway; gateways.<name> overlays shared for that gateway. An empty gateway entry disables one of the umbrella defaults.

The built-in public gateway terminates TLS and the built-in passthrough gateway forwards TLS. The umbrella also supports additional gateway instances, including an egress-type instance, but instance names, certificates, namespaces, and dependencies are umbrella integration concerns. See the Big Bang Istio configuration for the current integration contract.

Package configuration

The package renders an Istio Gateway resource from gateway.servers, a PeerAuthentication, an allow-all gateway-scoped AuthorizationPolicy, and network policies through bb-common. The default package configuration exposes HTTP on 8080 and HTTPS on 8443; the upstream Service maps those listeners to ports 80 and 443.

Big Bang-owned values include:

  • mtls.mode, which defaults to STRICT for the gateway workload.
  • bb-common.networkPolicies, enabled by default and rendered by the bb-common subchart.
  • classificationBanner, which adds a gateway-scoped Envoy filter for configured HTML hosts only.
  • gateway.servers, which defines the Istio gateway listeners.
  • waitJob, enabled by default to converge gateway proxy pods after the control plane changes the injected proxy version.

Use upstream for Istio gateway chart settings. The complete configuration surface is owned by Istio; see the locked Istio 1.31.1 gateway values. Big Bang sets the service type and listener mappings and applies the istio: ingressgateway label used by its integrations.

Security and network behavior

The package selects its policy resources with the gateway’s istio: ingressgateway and release-derived app labels. Its authorization policy allows traffic to that selected gateway workload; use the umbrella’s ingress and route integrations to control how applications use a gateway.

Gateway network policy input is derived by the umbrella from the configured listener ports. It allows ingress from the configured load-balancer subnet definition and egress from the gateway to Kubernetes workloads. Customize network-policy definitions through the umbrella configuration when the cluster’s load-balancer networks differ.

Gateway pods are explicitly labeled out of the ambient dataplane by the bundled Istio chart. This is intentional: ambient infrastructure and namespace enrollment are owned by the umbrella, Istio CNI, and ztunnel packages. The package CI exercises both normal and ambient Big Bang deployment selections, but ambient adoption is not configured in this chart.

Classification banners

Set classificationBanner.enabled and list exact hosts in classificationBanner.enabledHosts to inject a top banner into HTML responses served by that gateway. classificationLevel, text, and addFooter control the banner content and placement. The filter is not rendered when the feature is disabled or no hosts are listed.

packages:
  istioGateway:
    values:
      gateways:
        public:
          classificationBanner:
            enabled: true
            classificationLevel: controlled
            text: CONTROLLED (CUI)
            addFooter: true
            enabledHosts:
              - app.example.mil

Metrics and operations

The bundled gateway chart configures Prometheus scraping of the Envoy metrics endpoint by default. Refer to Istio’s standard metrics and the Big Bang monitoring package for collection and dashboard configuration.

The wait job waits for the gateway and istiod deployments, compares injected proxy versions with the control-plane version, and restarts the gateway Deployment only when its proxy pods are stale. Disabling it avoids that convergence behavior and should be an intentional operational decision.

For general gateway routing, TLS, health, scaling, and troubleshooting, use the version-appropriate Istio gateway documentation and Istio Helm installation guide.

Package boundaries

This repository owns the gateway wrapper and the resources described above. The umbrella owns source pins, gateway instances, certificate Secrets, value merging, release dependencies, namespaces, and Flux resources. Istio CRDs, istiod, Istio CNI, ztunnel, and the separately managed Istio egress gateway are outside this package.