Skip to content

Add note about istio-cni security #16749

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Add note about istio-cni security #16749

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3cb4721
Add note about istio-cni security
keithmattix Aug 4, 2025
cd0a1d5
Remove references to initcontainer
keithmattix Aug 7, 2025
0313630
Fix lint
keithmattix Aug 9, 2025
0ccbb9f
Update content/en/docs/ops/deployment/security-model/index.md
keithmattix Aug 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions content/en/docs/ops/deployment/security-model/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,10 @@ The implications of this are discussed [below](#node-compromise).
Because this consolidates the elevated privileges required to setup networking into a single pod, rather than *every* pod,
this option is generally recommended.

##### Ambient Mode

In ambient mode, the Istio CNI plugin (and the associated node agent) manages mesh enrollment for pods living on its node. Due to limitations in the Kubernetes API, it is not currently possible for the CNI plugin or its node agent to prevent pods from being scheduled on the node before the CNI plugin is installed and configured. In these rare cases (e.g. on node restart or new node scale out), it is possible that a pod that is labeled for mesh enrollment may come up before the CNI's traffic redirection rules are applied, meaning that policies won't be enforced until after the CNI comes up and that pod is restarted. The Istio community is working with the upstream Kubernetes community to address this limitation, but in the meantime, you can [configure an initcontainer](TODO) enabled [owned CNI mode](TODO) to mitigate these race conditions.

### Sidecar Proxies

Istio may [optionally](/docs/overview/dataplane-modes/) deploy a sidecar proxy next to an application.
Expand Down