docs: update GKE ambient guide to remove manual ResourceQuota step (Fix istio/istio#56376) #16660

parv18050212 · 2025-07-13T14:44:41Z

This PR updates the Istio ambient mesh installation guide for GKE:

Notes that Istio v1.26+ automatically creates ResourceQuota
Removes outdated manual step for newer versions
Keeps instructions for Istio <1.26 for clarity

Signed-off-by: Parv Agarwal [email protected]

istio/istio#56376) Signed-off-by: Parv Agarwal <[email protected]>

istio-policy-bot · 2025-07-13T14:44:45Z

😊 Welcome! This is either your first contribution to the Istio documentation repo, or
it's been a while since you've been here. A few things you should know:

You can learn about how we write and maintain documentation, our style guidelines,
and the available web site features by visiting Contributing to the Docs.
In the next few minutes, an automatic preview of your change will be built with
a full copy of the istio.io website. You can find this preview by clicking on
the Details link next to the deploy/netlify entry in the status section of this
page.
We care about quality, so we've put in place a number of checks to ensure our documentation
is top-notch. We do spell checking, sanitize the Markdown, ensure all hyperlinks point to a
valid location, and more. If your PR doesn't pass one of these checks, you'll see a red X in the
lint_istio.io entry in the status section. Click on the Details link to get a list of the
problems with your PR. Fix those problems and push an update; this will automatically re-run the
tests. Hopefully this time everything will be perfect!
Once your changes are accepted and merged into the repository, they will initially show up
on https://preliminary.istio.io. The changes will be published to https://istio.io
the next time we do a major release (which typically happens every 3 months or so).
To publish them sooner, add a cherrypick/release-x.xx label, where x.xx is the current
release of Istio.

Thanks for contributing!

Courtesy of your friendly welcome wagon.

istio-testing · 2025-07-13T14:44:53Z

Hi @parv18050212. Thanks for your PR.

I'm waiting for a istio member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

craigbox · 2025-07-14T02:49:05Z

content/en/docs/ambient/install/platform-prerequisites/index.md

+⚠️ **For Istio versions earlier than 1.26:**  
+You must manually create a ResourceQuota in the namespace (such as `istio-system`), for example:


Please use a shortcode for this kind of content.
(You won't be needing this after the changes so it's just a FYI)

content/en/docs/ambient/install/platform-prerequisites/index.md

craigbox · 2025-07-14T03:03:12Z

Because this is now more an FYI for people who don't want to install in istio-system (which will be very few people) I would be inclined to move the whole "Namespace restrictions" section to under the "platform profile" section.

craigbox · 2025-07-14T03:03:43Z

/ok-to-test

parv18050212 · 2025-07-14T03:09:31Z

Thanks for the suggestion, @craigbox! That makes sense. I’ll update the PR accordingly.

Co-authored-by: Craig Box <[email protected]>

content/en/docs/ambient/install/platform-prerequisites/index.md

craigbox · 2025-07-14T04:22:54Z

Fixed the error - please re-order the sections and I can merge.

Co-authored-by: Craig Box <[email protected]>

parv18050212 · 2025-07-14T10:24:50Z

I’ve now reordered the sections as suggested. The updated file is ready for review and merge.

craigbox · 2025-07-14T10:36:16Z

You seem to have lost all the edits that were made before you rearranged the content?

parv18050212 · 2025-07-14T11:18:24Z

Thanks for pointing that out! I've restored the earlier changes that were lost during the rearrangement. Let me know if anything else needs adjustment.

parv18050212 · 2025-07-14T11:56:03Z

@craigbox This is my first time contributing, and I’ve tried to follow all the guidelines, but I’m still getting a linting error I can’t figure out. Could you please help me understand what might be causing it? I'd really appreciate any guidance. Thanks!

dhawton · 2025-07-14T13:44:06Z

@craigbox This is my first time contributing, and I’ve tried to follow all the guidelines, but I’m still getting a linting error I can’t figure out. Could you please help me understand what might be causing it? I'd really appreciate any guidance. Thanks!

./en/docs/ambient/install/platform-prerequisites/index.md:197: MD024 Multiple headers with the same content

Means there are headers (which are #s) that share the same name. Headers have anchors applied to them, so they must be unique.

./en/docs/ambient/install/platform-prerequisites/index.md:211: MD029 Ordered list item prefix

Ordered lists (numbered) must all be prefixed with 1. In markdown, these will be numbered correctly... ie:

Bad

1. test
2. test
3. test

Good

1. test
1. test
1. test

dhawton

I think you have a formatter or something that is replacing a lot in this file that it shouldn't be.

dhawton · 2025-07-14T13:46:10Z

content/en/docs/ambient/install/platform-prerequisites/index.md


 ## CNI plugins

-The following configurations apply to all platforms, when certain {{< gloss "CNI" >}}CNI plugins{{< /gloss >}} are used:
+The following configurations apply to all platforms, when certain CNI plugins are used:


Why is this being changed?

dhawton · 2025-07-14T13:46:32Z

content/en/docs/ambient/install/platform-prerequisites/index.md

+2. Cilium's BPF masquerading is currently disabled by default, and has issues with Istio's use of link-local IPs for Kubernetes health checking. Enabling BPF masquerading via `bpf.masquerade=true` is not currently supported, and results in non-functional pod health checks in Istio ambient. Cilium's default iptables masquerading implementation should continue to function correctly.
+3. Due to how Cilium manages node identity and internally allow-lists node-level health probes to pods,
+   applying any default-DENY `NetworkPolicy` in a Cilium CNI install underlying Istio in ambient mode will cause `kubelet` health probes (which are by-default silently exempted from all policy enforcement by Cilium) to be blocked. This is because Istio uses a link-local SNAT address for kubelet health probes, which Cilium is not aware of, and Cilium does not have an option to exempt link-local addresses from policy enforcement.


This is where you're getting your ordered number linting failure. Not sure why these are being changed, however?

dhawton · 2025-07-14T13:46:45Z

content/en/docs/ambient/install/platform-prerequisites/index.md

-    {{< text syntax=yaml >}}
+    ```yaml


craigbox · 2025-07-15T02:07:57Z

Revert 7cb276f and I can tell you what is wrong with it at that stage.

(If all you are doing is swapping two blocks, then there shouldn't be any net-new headings)

parv18050212 · 2025-07-16T10:47:00Z

Hi all, I’ve updated the Platform Prerequisites and Namespace Restrictions sections to improve clarity and correctness, particularly for the GKE part. Everything else is copied directly from the original file.

docs: update GKE ambient guide to remove manual ResourceQuota step (Fix

4bc4815

istio/istio#56376) Signed-off-by: Parv Agarwal <[email protected]>

parv18050212 requested a review from a team as a code owner July 13, 2025 14:44

istio-testing added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. needs-ok-to-test labels Jul 13, 2025

parv18050212 mentioned this pull request Jul 13, 2025

ambient GKE docs: update section about manually creating ResourceQuota istio/istio#56376

Open

craigbox reviewed Jul 14, 2025

View reviewed changes

istio-testing added ok-to-test Set this label allow normal testing to take place for a PR not submitted by an Istio org member. and removed needs-ok-to-test labels Jul 14, 2025

Update content/en/docs/ambient/install/platform-prerequisites/index.md

26baa00

Co-authored-by: Craig Box <[email protected]>

istio-testing added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jul 14, 2025

Update content/en/docs/ambient/install/platform-prerequisites/index.md

bd30dac

Co-authored-by: Craig Box <[email protected]>

craigbox reviewed Jul 14, 2025

View reviewed changes

content/en/docs/ambient/install/platform-prerequisites/index.md Show resolved Hide resolved

parv18050212 and others added 3 commits July 14, 2025 15:28

Update content/en/docs/ambient/install/platform-prerequisites/index.md

65bd2df

Co-authored-by: Craig Box <[email protected]>

Merge branch 'istio:master' into fix/gke-resourcequota-56376

4a9b3a6

docs: move GKE Namespace restrictions below Platform profile

911fa08

istio-testing added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Jul 14, 2025

final updated

12cedb2

fixed lint error

7cb276f

istio-testing removed the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Jul 14, 2025

istio-testing added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jul 14, 2025

dhawton reviewed Jul 14, 2025

View reviewed changes

docs: corrected lint issues

8dd2737

istio-testing added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jul 16, 2025

parv18050212 added 2 commits July 16, 2025 16:37

docs: fix code block formatting for lint compliance in GKE section

cbf32dc

docs: prepend $ to bash code blocks to fix Hugo lint errors

cb82172

parv18050212 requested review from craigbox and dhawton July 19, 2025 13:20

		⚠️ For Istio versions earlier than 1.26:
		You must manually create a ResourceQuota in the namespace (such as `istio-system`), for example:

docs: update GKE ambient guide to remove manual ResourceQuota step (Fix istio/istio#56376) #16660

Are you sure you want to change the base?

docs: update GKE ambient guide to remove manual ResourceQuota step (Fix istio/istio#56376) #16660

Uh oh!

Conversation

parv18050212 commented Jul 13, 2025

Uh oh!

istio-policy-bot commented Jul 13, 2025

Uh oh!

istio-testing commented Jul 13, 2025

Uh oh!

craigbox Jul 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

craigbox commented Jul 14, 2025

Uh oh!

craigbox commented Jul 14, 2025

Uh oh!

parv18050212 commented Jul 14, 2025

Uh oh!

Uh oh!

craigbox commented Jul 14, 2025

Uh oh!

parv18050212 commented Jul 14, 2025

Uh oh!

craigbox commented Jul 14, 2025

Uh oh!

parv18050212 commented Jul 14, 2025

Uh oh!

parv18050212 commented Jul 14, 2025

Uh oh!

dhawton commented Jul 14, 2025

Uh oh!

dhawton left a comment

Choose a reason for hiding this comment

Uh oh!

dhawton Jul 14, 2025

Choose a reason for hiding this comment

Uh oh!

dhawton Jul 14, 2025

Choose a reason for hiding this comment

Uh oh!

dhawton Jul 14, 2025

Choose a reason for hiding this comment

Uh oh!

craigbox commented Jul 15, 2025

Uh oh!

parv18050212 commented Jul 16, 2025

Uh oh!

Uh oh!

craigbox Jul 14, 2025 •

edited

Loading