ServiceScope Implementation by jaellio · Pull Request #56497 · istio/istio

jaellio · 2025-06-03T19:47:29Z

Please provide a description of this PR:

This PR contains the initial alpha implementation of Service Scope for ambient mode multicluster configuration.

Included changes:

filtering of services to waypoints (waypoints and e/w gateways)
filtering of workloads to ztunnels (workloads belonging to the local cluster with locally scoped services and workloads belonging to globally scoped services)

Related API PR istio/api#3464

Resolves #55478

To do:

More encompassing unit tests
Integration test
Clean up
~~Update ambient default profile to only include a servicescope config if multicluster is enabled~~ Include a default servicescopeconfig. Unless the user has enabled multinetwork ambient, the servicescopeconfig selections will have no impact. Services are still global by default
Add tests and verify precedence of ServiceEntry settings (TODO in BETA)

istio-testing · 2025-06-03T19:47:32Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

jaellio · 2025-06-03T19:47:48Z

/test all

jaellio · 2025-06-03T21:41:59Z

/retest

jaellio · 2025-06-03T23:00:36Z

/retest

pilot/pkg/model/service.go

…dpoints Signed-off-by: Jackie Elliott <jaellio@microsoft.com> Pass MeshConfig to GlobalMergedWorkloadServicesCollection Signed-off-by: Jackie Elliott <jaellio@microsoft.com> Add cluster and listener service filtering for waypoints and e/w gateways Signed-off-by: Jackie Elliott <jaellio@microsoft.com> Respond to PR feedback Signed-off-by: Jackie Elliott <jaellio@microsoft.com> Add more tests Signed-off-by: Jackie Elliott <jaellio@microsoft.com> Fix incorrect waypoint logic. In ambient mode, e/w gateways and waypoints are both node.Type Waypoints Signed-off-by: Jackie Elliott <jaellio@microsoft.com> Remove unused ServicesForGateway Signed-off-by: Jackie Elliott <jaellio@microsoft.com> Updated failing lint and add a release note Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

flag for ambient multi network. Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

…ter-ambient-index4

Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

keithmattix · 2025-07-03T21:20:42Z

pilot/pkg/serviceregistry/kube/controller/ambient/services.go

 	networkGetter func(ctx krt.HandlerContext) network.ID,
 ) krt.TransformationSingle[*v1.Service, model.ServiceInfo] {
 	return func(ctx krt.HandlerContext, s *v1.Service) *model.ServiceInfo {
+		serviceScope := model.Local


I think in general, labeling the waypoints for the user could be a nice UX improvement, but we could get some user validation that it's useful first. We'd definitely want to call it out in docs first though

pkg/hbone/doubledialer.go

pkg/test/echo/server/forwarder/config.go

pkg/test/framework/components/istio/eastwest.go

pkg/test/framework/components/istio/gateway.go

tests/integration/ambient/main_test.go

waypoint has globally scoped services Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

multinetwork is enable to allow for existence even if no globally scoped services exist - utilize existing apps for integration tests Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

tests/integration/ambient/baseline_test.go

manifests/helm-profiles/ambient.yaml

status Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

for simplicity Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

therealmitchconnors

Low priority questions, but overall looks good.

tests/integration/ambient/main_test.go

pkg/test/framework/components/istio/kube.go

pkg/test/framework/components/istio/istio.go

keithmattix

Thanks! Will give a final review tomorrow

pilot/pkg/serviceregistry/kube/controller/ambient/ambientindex.go

than clusterids Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

keithmattix

Thanks! Will give a final review tomorrow

pilot/pkg/serviceregistry/kube/controller/ambient/ambientindex.go

keithmattix · 2025-07-08T17:31:16Z

pilot/pkg/serviceregistry/kube/controller/ambient/ambientindex.go

+			// Check if the service is a waypoint. If the service is not a waypoint
+			// or it's a waypoint containing no services then the Lookup will return
+			// an empty list
+			wpSvcs := a.services.ByOwningWaypointHostname.Lookup(NamespaceHostname{


We confirmed that waypoint services show up here?

I'll test this again manually

@keithmattix Added a hold until I push a feature flag check around calling AllLocalNetworkGlobalServices

pilot/pkg/serviceregistry/kube/controller/ambient/ambientindex.go

Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

istio-testing · 2025-07-09T19:50:16Z

In response to a cherrypick label: new pull request created: #56946

* upstream/master: update compatibility version files setting enable native sidecar to false (istio#56903) ServiceScope Implementation (istio#56497) Automator: update proxy@master in istio/istio@master (istio#56942)

istio-testing added the do-not-merge/work-in-progress Block merging of a PR because it isn't ready yet. label Jun 3, 2025

istio-policy-bot added area/ambient Issues related to ambient mesh area/networking area/user experience feature/Multi-cluster issues related with multi-cluster support labels Jun 3, 2025

istio-testing added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Jun 3, 2025

jaellio marked this pull request as ready for review June 6, 2025 22:09

jaellio requested review from a team as code owners June 6, 2025 22:09

jaellio changed the title ~~[WIP] ServiceScope Implementation~~ ServiceScope Implementation Jun 9, 2025

istio-testing removed the do-not-merge/work-in-progress Block merging of a PR because it isn't ready yet. label Jun 9, 2025

jaellio force-pushed the jaellio/multicluster-ambient-index branch 3 times, most recently from c7473f0 to fe74aad Compare June 9, 2025 21:58

dgn reviewed Jun 12, 2025

View reviewed changes

pilot/pkg/model/service.go Outdated Show resolved Hide resolved

jaellio force-pushed the jaellio/multicluster-ambient-index branch 4 times, most recently from 59774ae to 7f71a46 Compare June 19, 2025 22:58

istio-testing added the needs-rebase Indicates a PR needs to be rebased before being merged label Jun 25, 2025

jaellio added 4 commits June 25, 2025 16:58

Filter services in ServiceServiceBuilder and check feature

f70a203

flag for ambient multi network. Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

Move feature flag set to avoid race

dc887d0

Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

Fix race

f0832cc

Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

jaellio added 3 commits July 3, 2025 17:04

Respond to Keith's PR feedback

acb86cb

Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

Merge remote-tracking branch 'upstream/master' into jaellio/multiclus…

fa0b63e

…ter-ambient-index4

Fix gen

16b8f20

Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

keithmattix reviewed Jul 3, 2025

View reviewed changes

jaellio added 2 commits July 4, 2025 00:10

Add support waypoint visibility at network gateways when the

da3caae

waypoint has globally scoped services Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

- deploy e/w gateway with blackhole listener/cluster if ambient

d2129e2

multinetwork is enable to allow for existence even if no globally scoped services exist - utilize existing apps for integration tests Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

keithmattix requested changes Jul 7, 2025

View reviewed changes

tests/integration/ambient/baseline_test.go Outdated Show resolved Hide resolved

manifests/helm-profiles/ambient.yaml Outdated Show resolved Hide resolved

jaellio added 3 commits July 7, 2025 19:01

wait on eastwest gateway by checking programmed

f5e147d

status Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

Update default servicescopeconfig and duplicate DeployGatewayAPI

3f302fc

for simplicity Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

Fix indentation and remove unrelated file

9300956

Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

keithmattix removed the request for review from a team July 7, 2025 22:30

Compare networks rather than cluster id to determine locality

b6de08f

Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

therealmitchconnors reviewed Jul 7, 2025

View reviewed changes

tests/integration/ambient/main_test.go Outdated Show resolved Hide resolved

pkg/test/framework/components/istio/kube.go Show resolved Hide resolved

pkg/test/framework/components/istio/istio.go Show resolved Hide resolved

keithmattix reviewed Jul 7, 2025

View reviewed changes

pilot/pkg/serviceregistry/kube/controller/ambient/ambientindex.go Outdated Show resolved Hide resolved

Use correct address for e/w gateway and compare networks rather

f2ad931

than clusterids Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

keithmattix added the cherrypick/release-1.27 Set this label on a PR to auto-merge it to the release-1.27 branch label Jul 8, 2025

Add todo and remove duplicate config

e9abd4f

Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

keithmattix reviewed Jul 8, 2025

View reviewed changes

Add comment to fix e/w gateway service lookup perf in beta

dddb137

Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

keithmattix approved these changes Jul 8, 2025

View reviewed changes

jaellio mentioned this pull request Jul 8, 2025

Integration tests fail when unexpected Gateway API CRDs installed #56928

Closed

jaellio added the do-not-merge/hold Block automatic merging of a PR. label Jul 9, 2025

therealmitchconnors approved these changes Jul 9, 2025

View reviewed changes

Add feature flag check

a09d6d1

Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

jaellio removed the do-not-merge/hold Block automatic merging of a PR. label Jul 9, 2025

Fix lint

5e5178f

Signed-off-by: Jackie Elliott <jaellio@microsoft.com>

istio-testing merged commit 4d03a06 into istio:master Jul 9, 2025
30 checks passed

istio-testing mentioned this pull request Jul 9, 2025

[release-1.27] ServiceScope Implementation #56946

Merged

Conversation

jaellio commented Jun 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

istio-testing commented Jun 3, 2025

Uh oh!

jaellio commented Jun 3, 2025

Uh oh!

jaellio commented Jun 3, 2025

Uh oh!

jaellio commented Jun 3, 2025

Uh oh!

Uh oh!

keithmattix Jul 3, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

therealmitchconnors left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

keithmattix left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

keithmattix left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

keithmattix Jul 8, 2025

Choose a reason for hiding this comment

Uh oh!

jaellio Jul 8, 2025

Choose a reason for hiding this comment

Uh oh!

jaellio Jul 9, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

istio-testing commented Jul 9, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

jaellio commented Jun 3, 2025 •

edited

Loading