feat: add serviceMesh.mode in Package CR

docs/reference/UDS Core/prerequisites.md

@@ -68,12 +68,21 @@ In addition, to run Istio ingress gateways (part of Core) you will need to ensur
 
 ##### Ambient Mode
 
-Istio can be deployed in [Ambient Mode](https://istio.io/latest/docs/ambient/overview/) by deploying the optional `istio-ambient` component. This mode is still in alpha release and is not recommended for production use or for clusters requiring `FIPS` compliance. The `istio-ambient` component installs the Istio CNI plugin which requires specifying the `CNI_CONF_DIR` and `CNI_BIN_DIR` variables. These values can change based on the environment Istio is being deployed into. By default the package will attempt to auto-detect these values and will use the following values if not specified:
+Istio can be deployed in [Ambient Mode](https://istio.io/latest/docs/ambient/overview/) by deploying the optional `istio-ambient` component. This mode is still in alpha release and is not recommended for production use. Also note that only the `unicorn` and `registry1` flavors of core contain `FIPS` compliant images. The `istio-ambient` component is **required** if you want to use UDS Packages with `spec.network.serviceMesh.mode: ambient`. If Ambient mode is not deployed in the cluster, packages configured for ambient mode will automatically fall back to sidecar mode.
+
+When using ambient mode with UDS Packages, you can benefit from:
+- Reduced resource overhead compared to sidecar mode, as workloads don't require an injected sidecar container
+- Simplified deployment and operations for service mesh capabilities
+- Faster pod startup times since there's no need to wait for sidecar initialization
+
+Note that Packages with Authservice clients are not currently supported in ambient mode and will be rejected by the UDS Operator.
+
+The `istio-ambient` component installs the Istio CNI plugin which requires specifying the `CNI_CONF_DIR` and `CNI_BIN_DIR` variables. These values can change based on the environment Istio is being deployed into. By default the package will attempt to auto-detect these values and will use the following values if not specified:
 
 ```yaml
 # K3d cluster
 cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
-cniBinDir: /bin/
+cniBinDir: /opt/cni/bin/ # Historically this was `/bin/`
 
 # K3s cluster
 cniConfDir: /var/lib/rancher/k3s/agent/etc/cni/net.d
@@ -160,7 +169,6 @@ sysctl -p
 Metrics server is provided as an optional component in UDS Core and can be enabled if needed. For distros where metrics-server is already provided, ensure that you do NOT enable metrics-server. See the below as an example for enabling metrics-server if your cluster does not include it.
 
 ```yaml
----
 - name: uds-core
   repository: ghcr.io/defenseunicorns/packages/private/uds/core
   ref: 0.25.2-unicorn

docs/reference/configuration/Single Sign-On/auth-service.md

@@ -33,3 +33,5 @@ For a complete example, see [app-authservice-tenant.yaml](https://github.com/def
 
 ## Limitations:
 Authservice is intended for simple, basic protection scenarios where an absolute level of protection is acceptable. For more advanced authentication requirements, you should implement authentication directly in your application or via a more comprehensive solution.
+
+Authservice is currently not supported for ambient workloads (Package CR `network.serviceMesh.mode` of `ambient`). Package CRs with ambient configuration will be denied when applying if an Authservice SSO client is present. This restriction will be removed in the future once supported is added for this in the UDS Operator.

docs/reference/configuration/UDS operator/package.md

@@ -8,6 +8,8 @@ title: UDS Package
 
 - **Enabling Istio Sidecar Injection:**
   - The operator facilitates the activation of Istio sidecar injection within namespaces where the CR is deployed.
+- **Support for Istio Ambient Mode:**
+  - Packages can now opt into Istio's Ambient mode by setting `spec.network.serviceMesh.mode: ambient`. This provides service mesh capabilities and security without sidecars, reducing resource overhead.
 - **Establishing Default-Deny Ingress/Egress Network Policies:**
   - It sets up default-deny network policies for both ingress and egress, creating a foundational security posture.
 - **Implementing Layered Allow-List Approach:**
@@ -24,7 +26,9 @@ title: UDS Package
   - Authservice authentication provides application agnostic SSO for applications that opt-in.
 
 :::caution
-Warning: **Authservice Protection** and **SSO Group Authentication** are in Alpha and may not be stable. Avoid using in production. Feedback is appreciated to improve reliability.
+Warning: **Istio Ambient Mode** Package support is in Alpha and may not be stable. Different workloads may experience issues when migrating away from sidecars so testing in a development/staging environment is encouraged. In addition there are some known limitations with ambient support at this time:
+- `Package` CRs with AuthService SSO clients (`enableAuthserviceSelector`) are not supported in ambient mode. This is a limitation we plan to remove with operator support/configuration of [waypoint proxies](https://istio.io/latest/docs/ambient/usage/waypoint/), track progress on [this issue in GitHub](https://github.com/defenseunicorns/uds-core/issues/1200).
+- Metrics of applications in ambient mode will _NOT_ be scraped successfully by Prometheus when STRICT mTLS is being enforced (there may be workarounds to scrape in PERMISSIVE mode but this is not advised). This will be resolved once Prometheus is migrated to ambient mode.
 :::
 
 ### Example UDS Package CR
@@ -92,4 +96,4 @@ This example may not contain all fields, the full specification for the Package
 
 :::note
 More SSO Package examples might be found [here](/reference/configuration/single-sign-on/overview/).
-:::
+:::

docs/reference/configuration/custom resources/packages-v1alpha1-cr.md

@@ -108,7 +108,7 @@ sidebar:
     </tr>
   </thead>
   <tbody>
-    <tr><td style="white-space: nowrap;">allow</td><td style="white-space: nowrap;"><a href="#Allow">Allow[]</a></td><td>Allow specific traffic (namespace will have a default-deny policy)</td></tr><tr><td style="white-space: nowrap;">expose</td><td style="white-space: nowrap;"><a href="#Expose">Expose[]</a></td><td>Expose a service on an Istio Gateway</td></tr>
+    <tr><td style="white-space: nowrap;">allow</td><td style="white-space: nowrap;"><a href="#Allow">Allow[]</a></td><td>Allow specific traffic (namespace will have a default-deny policy)</td></tr><tr><td style="white-space: nowrap;">expose</td><td style="white-space: nowrap;"><a href="#Expose">Expose[]</a></td><td>Expose a service on an Istio Gateway</td></tr><tr><td style="white-space: nowrap;">serviceMesh</td><td style="white-space: nowrap;"><a href="#ServiceMesh">ServiceMesh</a></td><td>Service Mesh configuration for the package</td></tr>
   </tbody>
 </table>
 </div>
@@ -475,6 +475,24 @@ Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT</td></tr><tr><td style="
 </table>
 </div>
 
+<a id="ServiceMesh"></a>
+<div style="margin-left: 80px; padding-top: 30px;">
+
+#### ServiceMesh
+<table style="width: 100%; table-layout: fixed;">
+  <thead>
+    <tr>
+      <th style="width: 20%; white-space: nowrap;">Field</th>
+      <th style="width: 25%; white-space: nowrap;">Type</th>
+      <th style="width: 55%; white-space: nowrap;">Description</th>
+    </tr>
+  </thead>
+  <tbody>
+    <tr><td style="white-space: nowrap;">mode</td><td style="white-space: nowrap;">string (enum):<ul><li><code>sidecar</code></li><li><code>ambient</code></li></ul></td><td>Set the service mesh mode for this package (namespace), defaults to sidecar</td></tr>
+  </tbody>
+</table>
+</div>
+
 <a id="Sso"></a>
 <div style="margin-left: 60px; padding-top: 30px;">
 

schemas/package-v1alpha1.schema.json

@@ -155,6 +155,10 @@
             "$ref": "#/definitions/Expose"
           },
           "description": "Expose a service on an Istio Gateway"
+        },
+        "serviceMesh": {
+          "$ref": "#/definitions/ServiceMesh",
+          "description": "Service Mesh configuration for the package"
         }
       },
       "required": [],
@@ -787,6 +791,19 @@
       "required": [],
       "title": "FluffyURI"
     },
+    "ServiceMesh": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "mode": {
+          "$ref": "#/definitions/Mode",
+          "description": "Set the service mesh mode for this package (namespace), defaults to sidecar"
+        }
+      },
+      "required": [],
+      "title": "ServiceMesh",
+      "description": "Service Mesh configuration for the package"
+    },
     "Sso": {
       "type": "object",
       "additionalProperties": false,
@@ -1112,6 +1129,15 @@
       "title": "Gateway",
       "description": "The name of the gateway to expose the service on (default: tenant)"
     },
+    "Mode": {
+      "type": "string",
+      "enum": [
+        "sidecar",
+        "ambient"
+      ],
+      "title": "Mode",
+      "description": "Set the service mesh mode for this package (namespace), defaults to sidecar"
+    },
     "ClientAuthenticatorType": {
       "type": "string",
       "enum": [

src/pepr/config.ts

@@ -44,6 +44,9 @@ export const UDSConfig = {
 
   // Track if UDS Core identity-authorization layer is deployed
   isIdentityDeployed: false,
+
+  // Track if Istio Ambient optional components are deployed
+  isAmbientDeployed: false,
 };
 
 // configure subproject logger