Does Talos support installing Istio (especially Ambient mode)?

[moerwald]

Hi team 👋

I’m exploring Istio on a Talos-managed Kubernetes cluster and wondering about compatibility and support.

Specifically:

• Does Talos support installing Istio in general?
• And is Istio Ambient mode (sidecar-less mode with ztunnel) known to work on Talos?

Environment

• Talos OS: v1.11
• Kubernetes: v1.xx.x (Talos default)
• Istio: v1.27 (Ambient mode)
• CNI: Flannel

Thanks in advance for clarifying whether Istio (and especially Ambient mode) is compatible with Talos!

[smira]

Talos itself doesn't put any restrictions on any workloads. If there is a specific issue with a configuration of Istio which doesn't work on Talos because e.g. some kernel option is missing, we are happy to look into it.

[happenpappen]

Since PSA is einabled in Talos, you have to create the istio-system namespace and add these labels, before installing istio:

pod-security.kubernetes.io/enforce: privileged
pod-security.kubernetes.io/enforce-version: latest

Then "istioctl install --set profile=ambient" should work without problems.

There is a guide in the istio docs as well:

https://istio.io/latest/docs/setup/additional-setup/pod-security-admission/

I tried this with current release versions of Talos (1.11.5) and istio (1.28.1)