All Policies
Add Istio Ambient Mode
In order for Istio to include namespaces in ambient mode, the label `istio.io/dataplane-mode` must be set to `ambient`. As an alternative to rejecting Namespace definitions which don't already contain this label, it can be added automatically. This policy adds the label `istio.io/dataplane-mode` set to `ambient` for all new Namespaces.
Policy Definition
/istio/add-ambient-mode-namespace/add-ambient-mode-namespace.yaml
1apiVersion: kyverno.io/v1
2kind: ClusterPolicy
3metadata:
4 name: add-ambient-mode-namespace
5 annotations:
6 policies.kyverno.io/title: Add Istio Ambient Mode
7 policies.kyverno.io/category: Istio
8 policies.kyverno.io/severity: medium
9 kyverno.io/kyverno-version: 1.8.0
10 policies.kyverno.io/minversion: 1.6.0
11 kyverno.io/kubernetes-version: "1.24"
12 policies.kyverno.io/subject: Namespace
13 policies.kyverno.io/description: >-
14 In order for Istio to include namespaces in ambient mode, the label `istio.io/dataplane-mode`
15 must be set to `ambient`. As an alternative to rejecting Namespace definitions which don't already
16 contain this label, it can be added automatically. This policy adds the label `istio.io/dataplane-mode`
17 set to `ambient` for all new Namespaces.
18spec:
19 rules:
20 - name: add-ambient-mode-enabled
21 match:
22 any:
23 - resources:
24 kinds:
25 - Namespace
26 mutate:
27 patchStrategicMerge:
28 metadata:
29 labels:
30 istio.io/dataplane-mode: ambient