Support kgateway as a waypoint to Istio ambient

[linsun]

K8sGateway Version

latest

Is your feature request related to a problem? Please describe.

Can I run kgateway as a waypoint to Istio ambient? Istio ambient is designed with pluggable waypoints, would it be possible to have kgateway as a waypoint for Istio ambient?

If we do decide to support this, a few things to make decisions:

• I'd expect k8s GW API (HTTPRoute, Gateway etc) would be supported.

• Would kgateway support Istio's APIs or some of Istio's APIs? Examples to think through:

1. -- VS
2. -- DR
3. -- AuthorizationPolicy, PeerAuthPolicy
4. -- WasmPlugin?

• Can I also use the waypoint as an egress waypoint?

cc @asayah @Sodman @yuval-k @stevenctl @ilrudie

[ilrudie]

in Istio waypoints iirc:

• VS is still experimental or alpha and not recommended, we can probably skip it
• DR is partially supported but I don't recall off the top of my head which bits are supported

PeerAuthn is interesting. It might be irrelevant for waypoint as long as we're a sandwich. ztunnel would implement mTLS appropriately on our behalf.

AuthzPol I think is a firm must have for a waypoint.
DR needs research (or someone who just knows)

[yuval-k]

not sure about WasmPlugin, i don't believe we have seen it bring value to production users.

[yuval-k]

some context on DR being partially supported - It was done mainly to keep the scope of the DR support small for the initial implementation. Support more of it is possible.