Demo Install Istio Ambient Mode via CLI

This guide walks through installing Istio in ambient mode using the CLI, verifying dataplane behavior (ztunnel and CNI), labeling namespaces for ambient dataplane mode, running a test pod to confirm layer‑4 interception, and optionally deploying a waypoint proxy for layer‑7 features.

Ambient mode removes the sidecar proxy from workloads and uses a host‑level daemon (ztunnel) plus the Istio CNI for transparent L4 interception. Use waypoint proxies when you need layer‑7 features (HTTP routing, mirroring, fault injection).

1 — Download Istio and add istioctl to PATH

Download the desired Istio version (example uses 1.26.3) and add the bin folder to your PATH:

curl -L https://istio.io/downloadIstio | ISTIO_VERSION=1.26.3 sh -
export PATH=$PWD/bin:$PATH

Verify the client version (before install the cluster will not show control plane pods):

istioctl version
# Example output:
# Istio is not present in the cluster: no running Istio pods in namespace "istio-system"
# client version: 1.26.3

2 — Install Istio using the ambient profile

Install Istio with the ambient profile:

istioctl install --set profile=ambient -y
# Processing resources for Istio core.

Wait for the control plane components to become ready.

3 — Verify Istio system pods and daemonsets

Check pods in istio-system — ambient mode shows ztunnel and istio-cni-node:

kubectl get pods -n istio-system
# NAME                                READY   STATUS    RESTARTS   AGE
# istio-cni-node-xxxxx               1/1     Running   0          19s
# istiod-xxxx                        1/1     Running   0          27s
# ztunnel-xxxxx                      1/1     Running   0          13s

Check daemonsets (notice ztunnel and istio-cni-node run as DaemonSets):

kubectl get ds -n istio-system
# NAME            DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR                AGE
# istio-cni-node  1         1         1       1            1           kubernetes.io/os=linux       31s
# ztunnel         1         1         1       1            1           kubernetes.io/os=linux       25s

ztunnel: handles L4 traffic interception for workloads in ambient mode.
istio-cni-node: handles CNI and iptables conversions so workloads are transparently routed.

4 — Namespace labeling for ambient dataplane mode

In sidecar mode you’d label namespaces with istio-injection=enabled. For ambient mode, label namespaces with istio.io/dataplane-mode=ambient. Check current namespace labels:

kubectl get ns --show-labels
# NAME            STATUS   AGE   LABELS
# default         Active   3m7s  kubernetes.io/metadata.name=default
# istio-system    Active   73s   kubernetes.io/metadata.name=istio-system

istioctl analyze may still report injection info targeted at sidecar mode:

istioctl analyze -n default
# Info [IST0102] (Namespace default) The namespace is not enabled for Istio injection.
# Run 'kubectl label namespace default istio-injection=enabled' to enable it...

Label the default namespace for ambient dataplane mode:

kubectl label namespace default istio.io/dataplane-mode=ambient
# namespace/default labeled

Verify the label:

kubectl get ns --show-labels
# default Active ... istio.io/dataplane-mode=ambient,kubernetes.io/metadata.name=default

5 — Run a test workload and confirm traffic is intercepted by ztunnel

Create a simple test pod (NGINX image used here):

kubectl run test --image=nginx
# pod/test created
kubectl get pods
# NAME   READY   STATUS    RESTARTS   AGE
# test   1/1     Running   0          7s

Since ambient mode does not use a sidecar, the pod shows 1/1. ztunnel intercepts the host‑level L4 traffic. Tail ztunnel logs to observe intercepted connections:

kubectl logs -n istio-system -f <ztunnel-pod-name>
# Look for lines like:
# info    proxy::outbound listener established address=[::]:15001 component="outbound" transparent=true
# info    access  connection complete  src.workload="test" src.namespace="default" dst.addr=74.125.126.104:80 direction="outbound" bytes_sent=79 bytes_recv=1028 duration="63ms"

From the test pod, execute a simple curl to an external site to generate outbound traffic:

kubectl exec test -- curl --head www.google.com
# Should return HTTP/1.1 200 OK and headers

You should see corresponding access connection complete entries in the ztunnel logs. This confirms L4 interception and basic outbound connectivity through ztunnel.

Ambient mode provides transparent L4 interception out of the box. For L7 features (HTTP routing, mirroring, fault injection) you must deploy waypoint proxies and use Kubernetes Gateway API resources (e.g., HTTPRoute). These are distinct from Istio sidecar VirtualServices and require additional CRDs and configuration.

6 — Install Kubernetes Gateway API CRDs (required for waypoint + HTTPRoute)

Install the Gateway API CRDs (example uses Gateway API v1.3.0 standard install):

kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml
# customresourcedefinition.apiextensions.k8s.io/gatewayclasses.gateway.networking.k8s.io created
# customresourcedefinition.apiextensions.k8s.io/gateways.gateway.networking.k8s.io created
# customresourcedefinition.apiextensions.k8s.io/grpcroutes.gateway.networking.k8s.io created
# customresourcedefinition.apiextensions.k8s.io/htroutes.gateway.networking.k8s.io created
# customresourcedefinition.apiextensions.k8s.io/referencegrants.gateway.networking.k8s.io created

Verify CRDs (partial list):

kubectl get crd | grep gateway
# gatewayclasses.gateway.networking.k8s.io
# gateways.gateway.networking.k8s.io
# httproutes.gateway.networking.k8s.io

7 — Apply a waypoint proxy for layer‑7 capabilities (optional)

Create a waypoint in the namespace to enable an Envoy proxy as an entry point for L7 traffic:

istioctl waypoint apply -n default
# ✅ waypoint default/waypoint applied

Check pods: a waypoint Deployment will create a pod:

kubectl get pods
# NAME                                      READY   STATUS              RESTARTS   AGE
# test                                      1/1     Running             0          2m34s
# waypoint-7cb5d4bd6-crnmp                  1/1     Running             0          7s

Confirm the waypoint is created as a Deployment:

kubectl get deployments.apps
# NAME       READY   UP-TO-DATE   AVAILABLE   AGE
# waypoint   1/1     1            1           99s

Use waypoint proxies when you need the L7 features (HTTPRoute, mirroring, fault injection) — note these use Gateway API resources like HTTPRoute, which are Kubernetes-native and not Istio VirtualServices.

8 — Remove waypoint proxy (if desired)

To delete all waypoint resources in a namespace:

istioctl waypoint delete --all -n default
# waypoint default/waypoint deleted
kubectl get pods
# waypoint-* will be Terminating then removed

Quick reference — Commands summary

Task	Command
Download Istio	`curl -L https://istio.io/downloadIstio	ISTIO_VERSION=1.26.3 sh -`
Add istioctl to PATH	`export PATH=$PWD/bin:$PATH`
Install ambient profile	`istioctl install --set profile=ambient -y`
Check pods	`kubectl get pods -n istio-system`
Check daemonsets	`kubectl get ds -n istio-system`
Label namespace for ambient	`kubectl label namespace default istio.io/dataplane-mode=ambient`
Run a test pod	`kubectl run test --image=nginx`
Tail ztunnel logs	`kubectl logs -n istio-system -f <ztunnel-pod-name>`
Install Gateway API CRDs	`kubectl apply -f https://github.com/kubernetes-sigs/gateway-api/releases/download/v1.3.0/standard-install.yaml`
Apply waypoint	`istioctl waypoint apply -n default`
Delete waypoint	`istioctl waypoint delete --all -n default`

What to expect and exam note

Ambient mode: uses ztunnel (daemon) + istio-cni to transparently intercept L4 traffic. Workloads do not show a sidecar container.
Waypoint proxy: required for advanced L7 features. It relies on the Kubernetes Gateway API (Gateway, HTTPRoute) rather than Istio VirtualServices.
If you’re preparing for the ICA/field exam: you typically only need to know how to install ambient mode and label namespaces to enable dataplane interception (L4). Deep waypoint or HTTPRoute configuration is usually out of scope.

References

Istio Ambient Mode (official docs): https://istio.io/latest/docs/setup/additional-setup/ambient/
Gateway API (GitHub releases): https://github.com/kubernetes-sigs/gateway-api
istioctl documentation: https://istio.io/latest/docs/reference/commands/istioctl/

That’s the end of the demo — you should now have a working Istio ambient installation, observe L4 traffic handled by ztunnel, and understand when to use waypoint proxies for L7 features.

Introduction

Installation & Configuration

Traffic Management

Securing Workloads

Troubleshooting

Conclusion

Demo Install Istio Ambient Mode via CLI

1 — Download Istio and add istioctl to PATH

2 — Install Istio using the ambient profile

3 — Verify Istio system pods and daemonsets

4 — Namespace labeling for ambient dataplane mode

5 — Run a test workload and confirm traffic is intercepted by ztunnel

6 — Install Kubernetes Gateway API CRDs (required for waypoint + HTTPRoute)

7 — Apply a waypoint proxy for layer‑7 capabilities (optional)

8 — Remove waypoint proxy (if desired)

Quick reference — Commands summary

What to expect and exam note

References

Watch Video

Practice Lab

​1 — Download Istio and add istioctl to PATH

​2 — Install Istio using the ambient profile

​3 — Verify Istio system pods and daemonsets

​4 — Namespace labeling for ambient dataplane mode

​5 — Run a test workload and confirm traffic is intercepted by ztunnel

​6 — Install Kubernetes Gateway API CRDs (required for waypoint + HTTPRoute)

​7 — Apply a waypoint proxy for layer‑7 capabilities (optional)

​8 — Remove waypoint proxy (if desired)

​Quick reference — Commands summary

​What to expect and exam note

​References

Watch Video

Practice Lab

1 — Download Istio and add istioctl to PATH

2 — Install Istio using the ambient profile

3 — Verify Istio system pods and daemonsets

4 — Namespace labeling for ambient dataplane mode

5 — Run a test workload and confirm traffic is intercepted by ztunnel

6 — Install Kubernetes Gateway API CRDs (required for waypoint + HTTPRoute)

7 — Apply a waypoint proxy for layer‑7 capabilities (optional)

8 — Remove waypoint proxy (if desired)

Quick reference — Commands summary

What to expect and exam note

References