Istiod¶

istiod provides the Istio control plane for Big Bang. The package wraps the upstream Istiod chart and adds Big Bang-owned mesh resources, network policies, monitoring dashboards, and the legacy sidecar-scoped classification-banner EnvoyFilter.

This guide covers the package after Big Bang delivers its values. The umbrella chart owns package enablement, source and Flux release wiring, cross-package dependency ordering, and global-to-package value mapping.

Configuration¶

Enable Istiod with the canonical umbrella configuration key packages.istiod. The legacy istiod key remains supported for compatibility. Package-specific values are passed through the umbrella package values block.

The upstream parent in this package is the passthrough entry point for upstream Istiod 1.31.1 values. Use that version-matched source for upstream options; do not copy individual upstream settings into the Big Bang configuration contract.

Big Bang-owned package values include:

networkPolicies for control-plane ingress and Kubernetes API egress;
monitoring.enabled to render the package monitoring resources and policies;
istio settings consumed by bb-common, including sidecar support, strict mTLS, authorization-policy generation, and registry-only outbound traffic;
additionalEnvoyFilters for package-namespace filters; and
defaultSecurityHeaders.enabled for Big Bang default header behavior.

The package defaults enable strict mTLS and registry-only sidecar outbound traffic. Review effects on workloads and their required service entries before changing those controls. Big Bang configuration is layered by the umbrella, so package overrides should be made through the umbrella package values rather than by editing this chart’s defaults.

Control-plane integration¶

The umbrella deploys Istiod as release istiod in istio-system. Istio CRDs must be available before Istiod is reconciled. The umbrella may also arrange policy dependencies and map global monitoring, tracing, image-pull, SSO CA, and related mesh settings into this chart.

Those mappings and ambient-mode orchestration are umbrella-owned. Istio CRDs, CNI, gateways, ztunnel, and the egress gateway are separately owned packages; configure and troubleshoot their package-specific behavior in their respective documentation.

Istiod owns the legacy sidecar-scoped classification-banner EnvoyFilter. It selects workloads with the classification-banner.bigbang.dev/inject: "true" pod label and reads banner settings from workload pod annotations.

Gateway-scoped classification banners are owned by the istio-gateway package. Use that package for banners at ingress gateways, including ambient deployments where the sidecar-scoped filter does not apply to application workloads.

Security and network access¶

bb-common renders the Big Bang Istio and NetworkPolicy resources from this package’s istio and networkPolicies values. The default network-policy configuration permits the control plane to reach the Kubernetes API and allows control-plane webhook, monitoring, and proxy connections on the ports defined by the package values. Treat those interfaces as compatibility-sensitive when adding restrictive policy overrides.

Big Bang hardening, authorization-policy generation, mTLS, security headers, and mesh networking behavior are coupled. Coordinate changes that alter those controls with the umbrella integration and package tests rather than applying an isolated control-plane override.

Metrics and operations¶

When monitoring.enabled is enabled, the package includes Big Bang monitoring components and corresponding network-policy inputs. Use the Istio metrics reference and Istio observability guidance for metric semantics and general operational procedures.

For package development and integrated-cluster testing, see the repository’s development and maintenance guide. That guide can mutate a selected Kubernetes cluster and requires appropriate credentials; it is not an installation procedure for managed Big Bang environments.

Upgrades¶

Keep the upstream Istiod chart version, image metadata, and Big Bang overrides aligned when upgrading this package. Review the version-matched Istio release notes and validate a coordinated Istio stack through the umbrella before release. Upgrades to mesh security, networking, or ambient-related behavior require cross-package validation because their orchestration is not owned by this chart.