From 7b93ada20c513b73426c5beb1d5a377e4fbaf5bd Mon Sep 17 00:00:00 2001 From: Christopher Tauchen Date: Wed, 28 Jan 2026 11:33:05 +0000 Subject: [PATCH] Fix error in Istio ambient mode docs The docs for Istio ambient mode mistakenly described labelling namespaces and services to create the mesh. These labels work only for namespaces and pods, not services. DOCS-2828 --- .../compliance/istio/about-istio-ambient.mdx | 2 +- .../compliance/istio/deploy-istio-ambient.mdx | 20 +++++++++---------- .../compliance/istio/about-istio-ambient.mdx | 2 +- .../compliance/istio/deploy-istio-ambient.mdx | 20 +++++++++---------- .../compliance/istio/about-istio-ambient.mdx | 2 +- .../compliance/istio/deploy-istio-ambient.mdx | 20 +++++++++---------- .../compliance/istio/about-istio-ambient.mdx | 2 +- .../compliance/istio/deploy-istio-ambient.mdx | 20 +++++++++---------- 8 files changed, 44 insertions(+), 44 deletions(-) diff --git a/calico-cloud/compliance/istio/about-istio-ambient.mdx b/calico-cloud/compliance/istio/about-istio-ambient.mdx index 67d3c6587f..d577f75d7d 100644 --- a/calico-cloud/compliance/istio/about-istio-ambient.mdx +++ b/calico-cloud/compliance/istio/about-istio-ambient.mdx @@ -5,7 +5,7 @@ description: An overview of Calico's bundled version of Istio Ambient Mode # Istio Ambient Mode You can use $[prodname] to deploy and manage an Istio service mesh on your cluster. -$[prodname] installs Istio in ambient mode, which conserves resources while providing the same robust mTLS encryption for your services. +$[prodname] installs Istio in ambient mode, which conserves resources while providing the same robust mTLS encryption for your workloads. :::note diff --git a/calico-cloud/compliance/istio/deploy-istio-ambient.mdx b/calico-cloud/compliance/istio/deploy-istio-ambient.mdx index a2f650eb59..d32e7ed0fe 100644 --- a/calico-cloud/compliance/istio/deploy-istio-ambient.mdx +++ b/calico-cloud/compliance/istio/deploy-istio-ambient.mdx @@ -77,7 +77,7 @@ You can create an Istio service mesh in ambient mode by creating the `Istio` cus ## Add a workload to the Istio service mesh You can add workloads to the mesh by labeling them. -Communication between labelled namespaces and services goes through the mesh and uses mTLS encryption. +Communication between labelled namespaces and pods goes through the mesh and uses mTLS encryption. :::warning @@ -87,30 +87,30 @@ Doing this can cause interruptions and failure to your cluster network. If you want to secure $[prodname] components, see [Secure Calico component communications](../../operations/comms/index.mdx). ::: -1. To add workloads to your Istio service mesh, add the `istio.io/dataplane-mode=ambient` label to a service or namespace resource: +1. To add workloads to your Istio service mesh, add the `istio.io/dataplane-mode=ambient` label to a pod or namespace resource: ```bash title='Adding a namespace to the Istio service mesh' kubectl label namespace istio.io/dataplane-mode=ambient ``` Replace `` with the namespace you want to include in the mesh. - ```bash title='Adding a service to the Istio service mesh' - kubectl label service --namespace= istio.io/dataplane-mode=ambient + ```bash title='Adding a pod to the Istio service mesh' + kubectl label pod --namespace= istio.io/dataplane-mode=ambient ``` Replace the following: - * ``: The name of the service you want to include in the mesh. - * ``: The namespace your service is in. + * ``: The name of the pod you want to include in the mesh. + * ``: The namespace your pod is in. ## Removing Istio -If you want to remove Istio, first remove the labels you applied to services and namespaces. +If you want to remove Istio, first remove the labels you applied to pods and namespaces. When that's done, you can delete the `Istio` custom resource. -1. Remove the label from namespaces and services by running the following commands: +1. Remove the label from namespaces and pods by running the following commands: ```bash kubectl label namespaces --all istio.io/dataplane-mode=ambient- - kubectl label services --all --all-namespaces istio.io/dataplane-mode=ambient- + kubectl label pods --all --all-namespaces istio.io/dataplane-mode=ambient- ``` 1. Remove the `Istio` custom resource: @@ -132,7 +132,7 @@ Check whether Istio CRDs are deployed: kubectl get crd | grep istio ``` -Check which services and namespaces are in the mesh: +Check which pods and namespaces are in the mesh: * Requires [istioctl](https://istio.io/latest/docs/ops/diagnostic-tools/istioctl/). diff --git a/calico-enterprise/compliance/istio/about-istio-ambient.mdx b/calico-enterprise/compliance/istio/about-istio-ambient.mdx index 67d3c6587f..d577f75d7d 100644 --- a/calico-enterprise/compliance/istio/about-istio-ambient.mdx +++ b/calico-enterprise/compliance/istio/about-istio-ambient.mdx @@ -5,7 +5,7 @@ description: An overview of Calico's bundled version of Istio Ambient Mode # Istio Ambient Mode You can use $[prodname] to deploy and manage an Istio service mesh on your cluster. -$[prodname] installs Istio in ambient mode, which conserves resources while providing the same robust mTLS encryption for your services. +$[prodname] installs Istio in ambient mode, which conserves resources while providing the same robust mTLS encryption for your workloads. :::note diff --git a/calico-enterprise/compliance/istio/deploy-istio-ambient.mdx b/calico-enterprise/compliance/istio/deploy-istio-ambient.mdx index a2f650eb59..d32e7ed0fe 100644 --- a/calico-enterprise/compliance/istio/deploy-istio-ambient.mdx +++ b/calico-enterprise/compliance/istio/deploy-istio-ambient.mdx @@ -77,7 +77,7 @@ You can create an Istio service mesh in ambient mode by creating the `Istio` cus ## Add a workload to the Istio service mesh You can add workloads to the mesh by labeling them. -Communication between labelled namespaces and services goes through the mesh and uses mTLS encryption. +Communication between labelled namespaces and pods goes through the mesh and uses mTLS encryption. :::warning @@ -87,30 +87,30 @@ Doing this can cause interruptions and failure to your cluster network. If you want to secure $[prodname] components, see [Secure Calico component communications](../../operations/comms/index.mdx). ::: -1. To add workloads to your Istio service mesh, add the `istio.io/dataplane-mode=ambient` label to a service or namespace resource: +1. To add workloads to your Istio service mesh, add the `istio.io/dataplane-mode=ambient` label to a pod or namespace resource: ```bash title='Adding a namespace to the Istio service mesh' kubectl label namespace istio.io/dataplane-mode=ambient ``` Replace `` with the namespace you want to include in the mesh. - ```bash title='Adding a service to the Istio service mesh' - kubectl label service --namespace= istio.io/dataplane-mode=ambient + ```bash title='Adding a pod to the Istio service mesh' + kubectl label pod --namespace= istio.io/dataplane-mode=ambient ``` Replace the following: - * ``: The name of the service you want to include in the mesh. - * ``: The namespace your service is in. + * ``: The name of the pod you want to include in the mesh. + * ``: The namespace your pod is in. ## Removing Istio -If you want to remove Istio, first remove the labels you applied to services and namespaces. +If you want to remove Istio, first remove the labels you applied to pods and namespaces. When that's done, you can delete the `Istio` custom resource. -1. Remove the label from namespaces and services by running the following commands: +1. Remove the label from namespaces and pods by running the following commands: ```bash kubectl label namespaces --all istio.io/dataplane-mode=ambient- - kubectl label services --all --all-namespaces istio.io/dataplane-mode=ambient- + kubectl label pods --all --all-namespaces istio.io/dataplane-mode=ambient- ``` 1. Remove the `Istio` custom resource: @@ -132,7 +132,7 @@ Check whether Istio CRDs are deployed: kubectl get crd | grep istio ``` -Check which services and namespaces are in the mesh: +Check which pods and namespaces are in the mesh: * Requires [istioctl](https://istio.io/latest/docs/ops/diagnostic-tools/istioctl/). diff --git a/calico-enterprise_versioned_docs/version-3.22-2/compliance/istio/about-istio-ambient.mdx b/calico-enterprise_versioned_docs/version-3.22-2/compliance/istio/about-istio-ambient.mdx index 67d3c6587f..d577f75d7d 100644 --- a/calico-enterprise_versioned_docs/version-3.22-2/compliance/istio/about-istio-ambient.mdx +++ b/calico-enterprise_versioned_docs/version-3.22-2/compliance/istio/about-istio-ambient.mdx @@ -5,7 +5,7 @@ description: An overview of Calico's bundled version of Istio Ambient Mode # Istio Ambient Mode You can use $[prodname] to deploy and manage an Istio service mesh on your cluster. -$[prodname] installs Istio in ambient mode, which conserves resources while providing the same robust mTLS encryption for your services. +$[prodname] installs Istio in ambient mode, which conserves resources while providing the same robust mTLS encryption for your workloads. :::note diff --git a/calico-enterprise_versioned_docs/version-3.22-2/compliance/istio/deploy-istio-ambient.mdx b/calico-enterprise_versioned_docs/version-3.22-2/compliance/istio/deploy-istio-ambient.mdx index a2f650eb59..d32e7ed0fe 100644 --- a/calico-enterprise_versioned_docs/version-3.22-2/compliance/istio/deploy-istio-ambient.mdx +++ b/calico-enterprise_versioned_docs/version-3.22-2/compliance/istio/deploy-istio-ambient.mdx @@ -77,7 +77,7 @@ You can create an Istio service mesh in ambient mode by creating the `Istio` cus ## Add a workload to the Istio service mesh You can add workloads to the mesh by labeling them. -Communication between labelled namespaces and services goes through the mesh and uses mTLS encryption. +Communication between labelled namespaces and pods goes through the mesh and uses mTLS encryption. :::warning @@ -87,30 +87,30 @@ Doing this can cause interruptions and failure to your cluster network. If you want to secure $[prodname] components, see [Secure Calico component communications](../../operations/comms/index.mdx). ::: -1. To add workloads to your Istio service mesh, add the `istio.io/dataplane-mode=ambient` label to a service or namespace resource: +1. To add workloads to your Istio service mesh, add the `istio.io/dataplane-mode=ambient` label to a pod or namespace resource: ```bash title='Adding a namespace to the Istio service mesh' kubectl label namespace istio.io/dataplane-mode=ambient ``` Replace `` with the namespace you want to include in the mesh. - ```bash title='Adding a service to the Istio service mesh' - kubectl label service --namespace= istio.io/dataplane-mode=ambient + ```bash title='Adding a pod to the Istio service mesh' + kubectl label pod --namespace= istio.io/dataplane-mode=ambient ``` Replace the following: - * ``: The name of the service you want to include in the mesh. - * ``: The namespace your service is in. + * ``: The name of the pod you want to include in the mesh. + * ``: The namespace your pod is in. ## Removing Istio -If you want to remove Istio, first remove the labels you applied to services and namespaces. +If you want to remove Istio, first remove the labels you applied to pods and namespaces. When that's done, you can delete the `Istio` custom resource. -1. Remove the label from namespaces and services by running the following commands: +1. Remove the label from namespaces and pods by running the following commands: ```bash kubectl label namespaces --all istio.io/dataplane-mode=ambient- - kubectl label services --all --all-namespaces istio.io/dataplane-mode=ambient- + kubectl label pods --all --all-namespaces istio.io/dataplane-mode=ambient- ``` 1. Remove the `Istio` custom resource: @@ -132,7 +132,7 @@ Check whether Istio CRDs are deployed: kubectl get crd | grep istio ``` -Check which services and namespaces are in the mesh: +Check which pods and namespaces are in the mesh: * Requires [istioctl](https://istio.io/latest/docs/ops/diagnostic-tools/istioctl/). diff --git a/calico-enterprise_versioned_docs/version-3.23-1/compliance/istio/about-istio-ambient.mdx b/calico-enterprise_versioned_docs/version-3.23-1/compliance/istio/about-istio-ambient.mdx index 67d3c6587f..d577f75d7d 100644 --- a/calico-enterprise_versioned_docs/version-3.23-1/compliance/istio/about-istio-ambient.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-1/compliance/istio/about-istio-ambient.mdx @@ -5,7 +5,7 @@ description: An overview of Calico's bundled version of Istio Ambient Mode # Istio Ambient Mode You can use $[prodname] to deploy and manage an Istio service mesh on your cluster. -$[prodname] installs Istio in ambient mode, which conserves resources while providing the same robust mTLS encryption for your services. +$[prodname] installs Istio in ambient mode, which conserves resources while providing the same robust mTLS encryption for your workloads. :::note diff --git a/calico-enterprise_versioned_docs/version-3.23-1/compliance/istio/deploy-istio-ambient.mdx b/calico-enterprise_versioned_docs/version-3.23-1/compliance/istio/deploy-istio-ambient.mdx index a2f650eb59..d32e7ed0fe 100644 --- a/calico-enterprise_versioned_docs/version-3.23-1/compliance/istio/deploy-istio-ambient.mdx +++ b/calico-enterprise_versioned_docs/version-3.23-1/compliance/istio/deploy-istio-ambient.mdx @@ -77,7 +77,7 @@ You can create an Istio service mesh in ambient mode by creating the `Istio` cus ## Add a workload to the Istio service mesh You can add workloads to the mesh by labeling them. -Communication between labelled namespaces and services goes through the mesh and uses mTLS encryption. +Communication between labelled namespaces and pods goes through the mesh and uses mTLS encryption. :::warning @@ -87,30 +87,30 @@ Doing this can cause interruptions and failure to your cluster network. If you want to secure $[prodname] components, see [Secure Calico component communications](../../operations/comms/index.mdx). ::: -1. To add workloads to your Istio service mesh, add the `istio.io/dataplane-mode=ambient` label to a service or namespace resource: +1. To add workloads to your Istio service mesh, add the `istio.io/dataplane-mode=ambient` label to a pod or namespace resource: ```bash title='Adding a namespace to the Istio service mesh' kubectl label namespace istio.io/dataplane-mode=ambient ``` Replace `` with the namespace you want to include in the mesh. - ```bash title='Adding a service to the Istio service mesh' - kubectl label service --namespace= istio.io/dataplane-mode=ambient + ```bash title='Adding a pod to the Istio service mesh' + kubectl label pod --namespace= istio.io/dataplane-mode=ambient ``` Replace the following: - * ``: The name of the service you want to include in the mesh. - * ``: The namespace your service is in. + * ``: The name of the pod you want to include in the mesh. + * ``: The namespace your pod is in. ## Removing Istio -If you want to remove Istio, first remove the labels you applied to services and namespaces. +If you want to remove Istio, first remove the labels you applied to pods and namespaces. When that's done, you can delete the `Istio` custom resource. -1. Remove the label from namespaces and services by running the following commands: +1. Remove the label from namespaces and pods by running the following commands: ```bash kubectl label namespaces --all istio.io/dataplane-mode=ambient- - kubectl label services --all --all-namespaces istio.io/dataplane-mode=ambient- + kubectl label pods --all --all-namespaces istio.io/dataplane-mode=ambient- ``` 1. Remove the `Istio` custom resource: @@ -132,7 +132,7 @@ Check whether Istio CRDs are deployed: kubectl get crd | grep istio ``` -Check which services and namespaces are in the mesh: +Check which pods and namespaces are in the mesh: * Requires [istioctl](https://istio.io/latest/docs/ops/diagnostic-tools/istioctl/).