Refresh Ztunnel docs for Istio 1.22 Ambient Beta release

[MorrisLaw]

In preparation for the Ambient beta release in Istio 1.22, we'll need to ensure docs are up to date. This ticket addresses Ztunnel docs:

• Ensure that current Ztunnel documentation is refreshed/up-to-date:
  • docs/ambient/usage/ztunnel
  • docs/ops/ambient/usage/traffic-redirection
  • any other relevant Ztunnel docs here

[bleggett]

Would advocate that docs/ops/ambient/usage/traffic-redirection go under an architecture section, it is 100% an architectural explainer and 0% a usage guide.

[bleggett]

Would additionally advocate that we take the HBONE section out of docs/ambient/usage/ztunnel/ and spin it out as the start of an "HBONE" doc

#13482

(I may do this unless you want/intend to)

[bleggett]

Would additionally advocate that we take the HBONE section out of docs/ambient/usage/ztunnel/ and spin it out as the start of an "HBONE" doc

#13482

(I may do this unless you want/intend to)

#15004 all right, there.

Shouldn't impact you for this issue much, except it removes the HBONE section from the ztunnel doc.

[linsun]

A couple of things I'd like to see us clean up on the ztunnel page(https://preliminary.istio.io/latest/docs/ambient/usage/ztunnel/):

• remove alpha warning
• remove caveats - should be clear in release blog/note but no need to emphasize it in each doc.
• CP/DP overview - should move to architecture overview page.
• we should use the new istioctl x ztunnel-config cmd instead proxy-config imho.
• https://preliminary.istio.io/latest/docs/ambient/usage/ztunnel/#pod-selection-logic-for-ambient-and-sidecar-modes we don't support sidecar co-exist with sidecarless, worth update it to be clear.
• If an AuthorizationPolicy has been configured that requires any traffic processing beyond L4, and if no waypoint proxies are configured for the destination of the traffic, then ztunnel proxy will simply drop all traffic as a defensive move. Hence, check to ensure that either all rules involve L4 processing only or else if non-L4 rules are unavoidable, then waypoint proxies are also configured to handle policy enforcement. --- this is not correct, probably should drop it and cover it in a dedicated page for authz policy which I plan to create.
• https://preliminary.istio.io/latest/docs/ambient/usage/ztunnel/#ewside2ambient we won't support this for beta, consider dropping it.
• https://preliminary.istio.io/latest/docs/ambient/usage/ztunnel/#ewside2ambient: probably good to move to a dedicated doc to cover from ingress to ambient pods (ztunnel or ztunnel & waypoint).

[MorrisLaw]

we should use the new istioctl x ztunnel-config cmd instead proxy-config imho.

Good catch!! Definitely should not use proxy-config to get ztunnel info, it wouldn't work!

I'll push something up shortly to cover some of the things on that list, thank you for writing that up @linsun

[bleggett]

We should probably remove this whole section https://preliminary.istio.io/latest/docs/ambient/usage/ztunnel/#data-plane-overview

from the usage guide and link to "traffic redirection" in https://preliminary.istio.io/latest/docs/ambient/architecture/

EDIT: should be largely done with #15024

[craigbox]

You will want to review #15028 pretty closely, @linsun!

Regarding things that we won't support, it would be good to be clear about the difference between "we won't support this" and "it seems to Just Work", which was how the document was written to start with.

[MorrisLaw]

cc/ @linsun @craigbox @bleggett

A lot has been updated and moved at this point. How are we looking on the Ztunnel front? Should we close this out as complete now or are there some things still in flight?

[craigbox]

I'll move the L7 stuff around today and then I would love at least one person to read every page front to back.

[bleggett]

I'll move the L7 stuff around today and then I would love at least one person to read every page front to back.

I'll commit to doing that, @ me when you need it.

[MorrisLaw]

I'll move the L7 stuff around today and then I would love at least one person to read every page front to back.

I can also go through it when it's ready

[MorrisLaw]

@craigbox @bleggett has review for this already happened or are we waiting to review something specifically before closing this out? FWIW, the scope of this ticket is Ztunnel stuff (so not layer 7, waypoint docs).

[bleggett]

I believe we are good.