Add docs for enabling Istio native nftables feature by yxun · Pull Request #1122 · istio-ecosystem/sail-operator

yxun · 2025-08-15T19:07:10Z

This PR adds new doc and samples about the Istio native nftables feature. That feature was merged in the upstream release-1.27. This doc outlines the configuration steps using Sail Operator.

Documentation Update

Related issue: #1123

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

codecov · 2025-08-15T19:11:09Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.51%. Comparing base (8958564) to head (28e913c).
⚠️ Report is 86 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1122      +/-   ##
==========================================
+ Coverage   77.78%   80.51%   +2.72%     
==========================================
  Files          44       44              
  Lines        2823     2299     -524     
==========================================
- Hits         2196     1851     -345     
+ Misses        521      328     -193     
- Partials      106      120      +14

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

yxun · 2025-08-15T19:51:44Z

We don't have a version: v1.27 in Sail Operator now. So I use the version: v1.28-alpha.24646157 in this PR draft now. Will update that in a following commit.

sridhargaddam · 2025-08-18T08:22:45Z

chart/samples/istio-sample-nftables.yaml

@@ -0,0 +1,13 @@
+apiVersion: sailoperator.io/v1


While this looks good. In the longer run, we should use templates and update it based on the args.

I dont see this file used anywhere in the PR.

chart/samples/istiocni-sample-nftables.yaml

sridhargaddam · 2025-08-18T08:33:33Z

docs/common/istio-nftables.md

+
+This feature configures Istio to use the `nftables` backend instead of `iptables` for traffic redirection.
+
+#### Installation on OpenShift


Regarding the installation on OCP for Sail Operator, I feel we should link to the existing documentation rather than duplicating the steps here once again. If the steps require some explicit config that can be added as a note.

docs/common/istio-nftables.md

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

sridhargaddam

Thanks for looking into this @yxun

sridhargaddam · 2025-09-26T10:57:11Z

docs/common/istio-nftables.md

+
+### Installation
+
+The support for native nftables when using Istio sidecar mode was implemented in the upstream istio release-1.27 [release note](https://github.com/istio/istio/blob/master/releasenotes/notes/nftables-sidecar.yaml). It is disabled by default. To enable it, you can set a feature flag as `values.global.nativeNftables=true`. For example,


Suggested change

The support for native nftables when using Istio sidecar mode was implemented in the upstream istio release-1.27 [release note](https://github.com/istio/istio/blob/master/releasenotes/notes/nftables-sidecar.yaml). It is disabled by default. To enable it, you can set a feature flag as `values.global.nativeNftables=true`. For example,

The support for native nftables when using Istio sidecar mode was implemented in the upstream istio [release-1.27](https://github.com/istio/istio/blob/master/releasenotes/notes/nftables-sidecar.yaml). It is disabled by default. To enable it, you can set a feature flag as `values.global.nativeNftables=true`. For example,

sridhargaddam · 2025-09-26T10:58:27Z

docs/common/istio-nftables.md

+Installation with Helm
+
+```sh
+helm install istiod-canary istio/istiod \


Since we are talking about nftables, we can avoid using "istiod-canary"

Suggested change

helm install istiod-canary istio/istiod \

helm install istiod istio/istiod \

sridhargaddam · 2025-09-26T10:59:10Z

docs/common/istio-nftables.md

+metadata:
+  name: default
+spec:
+  version: v1.28-alpha.24646157


We can use 1.27 (or whatever is the latest supported version) here.

sridhargaddam · 2025-09-26T11:01:03Z

docs/common/istio-nftables.md

+  updateStrategy:
+    type: InPlace
+    inactiveRevisionDeletionGracePeriodSeconds: 30


Since the updateStrategy section is anyways using the defaults, we can avoid specifying it in the yamls.

sridhargaddam · 2025-09-26T11:05:09Z

docs/common/istio-nftables.md

+```sh
+kubectl apply -f - <<EOF
+    apiVersion: operators.coreos.com/v1alpha1
+    kind: Subscription
+    metadata:
+      name: sailoperator
+      namespace: openshift-operators
+    spec:
+      channel: "1.27-nightly"
+      installPlanApproval: Automatic
+      name: sailoperator
+      source: community-operators
+      sourceNamespace: openshift-marketplace
+EOF
+```


As this document is for Sail Operator, lets avoid any OpenShift specific notes. Please use appropriate mechanism for Kind cluster.

sridhargaddam · 2025-09-26T11:06:27Z

docs/common/istio-nftables.md

+    inactiveRevisionDeletionGracePeriodSeconds: 30
+  values:
+    global:
+      nativeNftables: true


Actually you can remove this whole section since we are capturing the same info below.

sridhargaddam · 2025-09-26T11:08:02Z

docs/common/istio-nftables.md

+```
+
+#### Install in Ambient Mode
+


Is this a TODO?

yes, the Ambient mode part install and upgrade is in progress. When that part is clear, I will update the upgrade task JIRA and this PR draft.

sridhargaddam · 2025-09-26T11:08:27Z

docs/common/istio-nftables.md

+kubectl apply -n test-ns -f https://raw.githubusercontent.com/istio/istio/refs/heads/master/samples/curl/curl.yaml
+```
+
+Attach a debug container and you will get the following rules in the `istio-proxy` container:


Suggested change

Attach a debug container and you will get the following rules in the `istio-proxy` container:

Attach a debug container and you can see the nftable rules from the `istio-proxy` container:

sridhargaddam · 2025-09-26T13:31:18Z

docs/common/istio-nftables.md

+
+### Upgrade
+
+The migration of using the existing Istio iptables backend to nftables backend can be done by upgrading Istio. The following example installs an Istio control plane with the iptables backend and a sample application curl in a data plane namespace test-ns.


Suggested change

The migration of using the existing Istio iptables backend to nftables backend can be done by upgrading Istio. The following example installs an Istio control plane with the iptables backend and a sample application curl in a data plane namespace test-ns.

The migration from iptables backend to nftables backend can be done by upgrading Istio. The following example installs an Istio control plane with the iptables backend and a sample application in test-ns namespace.

sridhargaddam · 2025-09-26T13:32:17Z

docs/common/istio-nftables.md

+The migration of using the existing Istio iptables backend to nftables backend can be done by upgrading Istio. The following example installs an Istio control plane with the iptables backend and a sample application curl in a data plane namespace test-ns.
+
+```sh
+istioctl install -y


As this is a Sail Operator doc, lets use the installation mechanisms supported in Sail Operator.

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

yxun · 2025-10-01T08:30:55Z

This PR is still WIP. I tried the Sail Operator 1.27.1 but still getting the following error

IstioCNI default violates policy 299 - "unknown field "spec.values.global.nativeNftables""

The api field PR was merged in #1183
I am reopening JIRA https://issues.redhat.com/browse/OSSM-10589

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

yxun · 2025-10-08T07:02:44Z

@sridhargaddam

Here are two findings :
1. When using Sail Operator, the upgraded IstioCNI and Istio resources spec.version value need to be different from the prior instances. Otherwise, the appended spec.values will not be configured.
2. After ambient mode upgrade, the data plane application deployment(s) still need a restart so that new rules can be applied in the pod network.

The doc PR is ready for review. Thanks.

sridhargaddam · 2025-10-16T16:00:07Z

chart/samples/istio-sample-nftables.yaml

+  updateStrategy:
+    type: InPlace
+    inactiveRevisionDeletionGracePeriodSeconds: 30


Lets remove these fields as they are anyways default.

sridhargaddam · 2025-10-16T16:04:36Z

docs/common/istio-nftables.adoc

+When you install IstioCNI and Istio resources with Sail Operator, you can create an instance of them with `+spec.values.global.nativeNftables=true+`. 
+This feature configures Istio to use the `+nftables+` backend instead of `+iptables+` for traffic redirection.


Suggested change

When you install IstioCNI and Istio resources with Sail Operator, you can create an instance of them with `+spec.values.global.nativeNftables=true+`.

This feature configures Istio to use the `+nftables+` backend instead of `+iptables+` for traffic redirection.

When installing `Istio` and `IstioCNI` resources with the Sail Operator, you can enable nftables by setting `spec.values.global.nativeNftables=true` in the resource. This option configures Istio to use the nftables backend for traffic redirection instead of iptables.

sridhargaddam · 2025-10-16T16:05:19Z

docs/common/istio-nftables.adoc

+
+To enable the native nftables feature, using the following steps:
+
+[arabic]


Not sure what this is for. Can you eloborate?

That was automatically generated when I run make gen-api-docs . I can remove that asciidoc format mark.

sridhargaddam · 2025-10-16T16:06:27Z

docs/common/istio-nftables.adoc

+When you install IstioCNI and Istio resources with Sail Operator, you can create an instance of them with `+spec.values.global.nativeNftables=true+`. 
+This feature configures Istio to use the `+nftables+` backend instead of `+iptables+` for traffic redirection.
+
+To enable the native nftables feature, using the following steps:


We can remove this line as we already mentioned above how to enable nftables.

sridhargaddam · 2025-10-16T16:08:06Z

docs/common/istio-nftables.adoc

+metadata:
+  name: default
+spec:
+  version: v1.27.2


This should be updated to version 1.28

sridhargaddam · 2025-10-16T16:10:00Z

docs/common/istio-nftables.adoc

+==== Validation
+
+When using the `+nftables+` backend, you can verify the traffic redirection rules using the `+nft list ruleset+` command in a data plane application or sidecar container. 
+You can find all rules are in the `+inet+` table. The following example installs a sample application `+curl+` in a data plane namespace `+test-ns+`.


Suggested change

You can find all rules are in the `+inet+` table. The following example installs a sample application `+curl+` in a data plane namespace `+test-ns+`.

You can find all rules are in the `+inet+` table. The following example installs a sample application `+curl+` in a namespace `+test-ns+` that is part of the mesh.

sridhargaddam · 2025-10-16T16:14:52Z

docs/common/istio-nftables.adoc

+
+When using Sail Operator, the upgraded `IstioCNI` and `Istio` resources `spec.version` value need to be different from the prior instances. Otherwise, the appended `spec.values` will not be configured.
+
+===== Upgrade with Sail Operator on OpenShift


Suggested change

===== Upgrade with Sail Operator on OpenShift

===== Upgrade using Sail Operator

sridhargaddam · 2025-10-16T16:15:19Z

docs/common/istio-nftables.adoc

+
+===== Upgrade with Sail Operator on OpenShift
+
+To upgrade an iptable based Istio service mesh, using the following steps:


Suggested change

To upgrade an iptable based Istio service mesh, using the following steps:

To upgrade an iptable based Istio service mesh with nftables backend, use the following steps:

sridhargaddam · 2025-10-16T16:16:33Z

docs/common/istio-nftables.adoc

+. Upgrade the IstioCNI and Istio control plane with `+spec.values.global.nativeNftables=true+`. 
+More details about the Update Strategy are described in link:../update-strategy/update-strategy.adoc[update-strategy.adoc]. For example,
+
+[source,sh]


The whole of the section is redundant, we are just repeating things again. Please re-work on the section below. We dont have to show the Yamls again, just include a note saying that spec.values.global.nativeNftables should be set to true in Istio and IstioCNI CRs.

sridhargaddam · 2025-10-16T16:18:46Z

docs/common/istio-nftables.adoc

+
+[source,sh]
+----
+kubectl rollout restart deployment -n test-ns


hmm... we should find a way to support re-programming the new rules without having to restart the pods. Did you take a look at the code to understand what it does when config changes and the rules do not match?

sridhargaddam · 2025-10-16T16:19:33Z

When using Sail Operator, the upgraded IstioCNI and Istio resources spec.version value need to be different from the prior instances. Otherwise, the appended spec.values will not be configured.

Are you saying that when we update any spec.values (without modifying the version) the updated values are not reflected in the Istio deployment?
Looping @dgn to check if this is some known.

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

yxun · 2025-10-20T02:12:04Z

When using Sail Operator, the upgraded IstioCNI and Istio resources spec.version value need to be different from the prior instances. Otherwise, the appended spec.values will not be configured.

Are you saying that when we update any spec.values (without modifying the version) the updated values are not reflected in the Istio deployment? Looping @dgn to check if this is some known.

yes, I am not clear about other spec.values settings. When I added the +spec.values.global.nativeNftables=true+, it was only applied when I changed the spec.version value for an in place upgrade scenario.

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

yxun · 2025-11-07T20:52:56Z

When using Sail Operator, the upgraded IstioCNI and Istio resources spec.version value need to be different from the prior instances. Otherwise, the appended spec.values will not be configured.

When I run the latest Sail operator 1.27.3+ , I see Istio values overrides behavior works correctly in this upgrade case.
There was already an unit test file covering that.
https://github.com/istio-ecosystem/sail-operator/blob/main/pkg/istiovalues/overrides_test.go

My Quote finding was not correct. It could be caused by running an old Istio version which had not included nftables change there.

yxun · 2025-11-07T20:55:16Z

hmm... we should find a way to support re-programming the new rules without having to restart the pods.

Still work in progress about the re-programming rule changes without having to restart the application pods.

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

yxun · 2025-11-21T15:37:13Z

The Safe migration/upgrade change was created in the upstream PR: istio/istio#58354

I have upgraded this doc PR and it's ready for review.

sridhargaddam · 2025-11-21T17:02:42Z

docs/common/istio-nftables.adoc

+
+=== Installation
+
+The support for native nftables in Istio sidecar mode was implemented in the upstream istio https://github.com/istio/istio/blob/master/releasenotes/notes/nftables-sidecar.yaml[release-1.27].


Probably we can link the official release announcement here - https://istio.io/latest/news/releases/1.27.x/announcing-1.27/

sridhargaddam · 2025-11-21T17:03:07Z

docs/common/istio-nftables.adoc

+
+==== Install in Ambient Mode
+
+The support for native nftables in Istio ambient mode was implemented in the upstream istio `+release-1.28+`. 


and here - https://istio.io/latest/news/releases/1.28.x/announcing-1.28/

sridhargaddam · 2025-11-21T17:05:14Z

docs/common/istio-nftables.adoc

+[source,sh]
+----
+cat <<EOF | kubectl apply -f-
+apiVersion: sailoperator.io/v1alpha1


While using v1alpha1 is not an issue, its better to change all the docs to use v1

docs/common/istio-nftables.adoc

sridhargaddam · 2025-11-21T17:10:16Z

docs/common/istio-nftables.adoc

+When an existing Istio Ambient deployment using the iptables backend is upgraded to the nftables backend, IstioCNI doesn't switch to nftables silently.
+The IstioCNI initialization code detects any iptables artifacts on the host first. If it finds them, it overrides the nftables setting, keeps using the iptables backend, and logs a message telling users to reboot the node to complete the migration.
+After a reboot, the old iptables artifacts are cleared and pods come up with clean namespaces, completing the upgrade and migration automatically.


Lets move this to the ambient section.

sridhargaddam · 2025-11-21T17:10:43Z

docs/common/istio-nftables.adoc

+. Check existing `+Istio+` and `+IstioCNI+` resources’ state are Healthy.
+
+[start=2]
+. Enable nftables by setting `spec.values.global.nativeNftables=true` in the `+Istio+` and `+IstioCNI+` resources. You can find the same example manifests in the Installation section above.


Suggested change

. Enable nftables by setting `spec.values.global.nativeNftables=true` in the `+Istio+` and `+IstioCNI+` resources. You can find the same example manifests in the Installation section above.

. Enable nftables by setting `spec.values.global.nativeNftables=true` in the `+Istio+` and `+IstioCNI+` resources. You can find the sample manifests in the Installation section above.

sridhargaddam · 2025-11-21T17:11:21Z

docs/common/istio-nftables.adoc

+. Enable nftables by setting `spec.values.global.nativeNftables=true` in the `+Istio+` and `+IstioCNI+` resources. You can find the same example manifests in the Installation section above.
+
+[start=3]
+. Update the data plane namespace `+test-ns+` by restarting all deployments. For example,


Suggested change

. Update the data plane namespace `+test-ns+` by restarting all deployments. For example,

. Update the data plane by restarting the application workloads that are part of the mesh. For example,

sridhargaddam · 2025-11-21T17:11:59Z

docs/common/istio-nftables.adoc

+
+==== Upgrade in Ambient mode
+
+. Enable nftables with `+ambient+` profile by setting `spec.values.global.nativeNftables=true` in the `+Istio+` and `+IstioCNI+` resources. You can find the same example manifests in the Installation section above.


Suggested change

. Enable nftables with `+ambient+` profile by setting `spec.values.global.nativeNftables=true` in the `+Istio+` and `+IstioCNI+` resources. You can find the same example manifests in the Installation section above.

. Enable nftables with `+ambient+` profile by setting `spec.values.global.nativeNftables=true` in the `+Istio+` and `+IstioCNI+` resources. You can find the sample manifests in the Installation section above.

sridhargaddam · 2025-11-21T17:13:32Z

docs/common/istio-nftables.adoc

+. Enable nftables with `+ambient+` profile by setting `spec.values.global.nativeNftables=true` in the `+Istio+` and `+IstioCNI+` resources. You can find the same example manifests in the Installation section above.
+
+[start=2]
+. If you get the following IstioCNI log message like `To complete migration to nftables, reboot the node`, reboot each node. You don't need restarting application deployment pods because the Reconcile flag was enabled in Ambient mode IstioCNI.


Suggested change

. If you get the following IstioCNI log message like `To complete migration to nftables, reboot the node`, reboot each node. You don't need restarting application deployment pods because the Reconcile flag was enabled in Ambient mode IstioCNI.

. Restart the cluster nodes to complete the migration from iptables backend to nftables backend.

sridhargaddam · 2025-11-21T17:15:01Z

Please look into the review comments. I've added "/hold" as the corresponding upstream PR is not yet merged.

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

yxun · 2025-11-21T17:53:45Z

Ok, I have updated all review updates and will hold this doc PR.

sridhargaddam · 2025-11-24T09:07:28Z

chart/samples/istio-sample-nftables.yaml

@@ -0,0 +1,13 @@
+apiVersion: sailoperator.io/v1


I dont see this file used anywhere in the PR.

sridhargaddam · 2025-11-24T09:07:36Z

chart/samples/istiocni-sample-nftables.yaml

@@ -0,0 +1,10 @@
+apiVersion: sailoperator.io/v1


Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

fjglira

Adding variable to be replaced in the rendered view. I think is safe to replace all the hardcoded Istio version with version: {istio_latest_tag} because currently it points to 1.28 and is already mentioned in the doc that the support for nft table start on 1,27 and the support for nft tables in Ambient starts in 1.28

fjglira · 2025-12-02T10:43:35Z

docs/common/istio-nftables.adoc

+metadata:
+  name: default
+spec:
+  version: v1.28-latest


Suggested change

version: v1.28-latest

version: {istio_latest_tag}

fjglira · 2025-12-02T10:43:43Z

docs/common/istio-nftables.adoc

+metadata:
+  name: default
+spec:
+  version: v1.28-latest


Suggested change

version: v1.28-latest

version: {istio_latest_tag}

fjglira · 2025-12-02T10:43:51Z

docs/common/istio-nftables.adoc

+metadata:
+  name: default
+spec:
+  version: v1.28-latest


Suggested change

version: v1.28-latest

version: {istio_latest_tag}

fjglira · 2025-12-02T10:44:32Z

docs/common/istio-nftables.adoc

+metadata:
+  name: default
+spec:
+  version: v1.27-latest


Suggested change

version: v1.27-latest

version: {istio_latest_tag}

fjglira · 2025-12-02T10:44:39Z

docs/common/istio-nftables.adoc

+metadata:
+  name: default
+spec:
+  version: v1.27-latest


Suggested change

version: v1.27-latest

vversion: {istio_latest_tag}

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

sridhargaddam

Upstream PR is now merged.

fjglira · 2025-12-03T09:31:42Z

/test e2e-kind-olm

* upstream/main: Add docs for enabling Istio native nftables feature (istio-ecosystem#1122)

…1122) * update docs: add terminology Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com> * Add docs for istio nftables Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com> * Add installation steps on OpenShift Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com> * Update Istio nftables doc Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com> * update doc Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com> * update docs Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com> * add converted ascii istio-nftables.adoc Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com> * remove markdown doc file Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com> * update docs: fix typo and commit check Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com> * update docs Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com> * review updates Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com> * update istio-nftables doc Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com> * doc: update nftables doc upgrade part (istio-ecosystem#1122) Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com> * review updates Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com> * remove unused sample files Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com> * update version tag Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com> --------- Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com> Signed-off-by: Daniel Grimm <dgrimm@redhat.com>

yxun added 3 commits August 15, 2025 10:12

update docs: add terminology

5d59776

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

Add docs for istio nftables

bf8c65e

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

Add installation steps on OpenShift

92b36e1

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

yxun requested a review from a team as a code owner August 15, 2025 19:07

istio-testing added the size/L label Aug 15, 2025

yxun changed the title ~~release-1.27: Add docs for enabling Istio native nftables feature~~ Add docs for enabling Istio native nftables feature Aug 15, 2025

yxun marked this pull request as draft August 15, 2025 19:10

istio-testing added the do-not-merge/work-in-progress label Aug 15, 2025

sridhargaddam reviewed Aug 18, 2025

View reviewed changes

FilipB added the cherrypick/release-1.27 label Sep 11, 2025

Merge from main

ef831d2

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

istio-testing added size/XL and removed size/L labels Sep 23, 2025

yxun marked this pull request as ready for review September 24, 2025 00:30

istio-testing removed the do-not-merge/work-in-progress label Sep 24, 2025

yxun marked this pull request as draft September 24, 2025 01:08

istio-testing added the do-not-merge/work-in-progress label Sep 24, 2025

Merge remote-tracking branch 'eco/main' into nft-doc

e27c7e6

yxun force-pushed the nft-doc branch 2 times, most recently from 11eb9e9 to 79a1d1b Compare September 25, 2025 19:54

istio-testing added size/L and removed size/XL labels Sep 25, 2025

Update Istio nftables doc

329ec6e

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

yxun force-pushed the nft-doc branch from 79a1d1b to 329ec6e Compare September 25, 2025 20:01

sridhargaddam reviewed Sep 26, 2025

View reviewed changes

update doc

bacfac1

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

yxun changed the title ~~Add docs for enabling Istio native nftables feature~~ WIP: Add docs for enabling Istio native nftables feature Oct 1, 2025

update docs

8a2d4a7

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

yxun requested a review from sridhargaddam October 8, 2025 07:02

sridhargaddam reviewed Oct 16, 2025

View reviewed changes

review updates

1340b2b

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

update istio-nftables doc

f89ca91

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

doc: update nftables doc upgrade part (istio-ecosystem#1122)

f7de57d

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

yxun force-pushed the nft-doc branch from fb3cd44 to f7de57d Compare November 21, 2025 15:32

sridhargaddam requested changes Nov 21, 2025

View reviewed changes

sridhargaddam added the do-not-merge/hold label Nov 21, 2025

review updates

c48d831

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

sridhargaddam reviewed Nov 24, 2025

View reviewed changes

yxun force-pushed the nft-doc branch 2 times, most recently from ed3b33b to c48d831 Compare November 24, 2025 13:32

remove unused sample files

686fb07

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

fjglira reviewed Dec 2, 2025

View reviewed changes

update version tag

28e913c

Signed-off-by: Yuanlin Xu <yuanlin.xu@redhat.com>

sridhargaddam removed the do-not-merge/hold label Dec 3, 2025

sridhargaddam approved these changes Dec 3, 2025

View reviewed changes

istio-testing merged commit 385ce6d into istio-ecosystem:main Dec 3, 2025
16 of 17 checks passed

openshift-service-mesh-bot pushed a commit to openshift-service-mesh-bot/sail-operator that referenced this pull request Dec 3, 2025

Automated merge

f223d98

* upstream/main: Add docs for enabling Istio native nftables feature (istio-ecosystem#1122)


		This feature configures Istio to use the `nftables` backend instead of `iptables` for traffic redirection.

		#### Installation on OpenShift


		### Installation

		The support for native nftables when using Istio sidecar mode was implemented in the upstream istio release-1.27 [release note](https://github.com/istio/istio/blob/master/releasenotes/notes/nftables-sidecar.yaml). It is disabled by default. To enable it, you can set a feature flag as `values.global.nativeNftables=true`. For example,

	helm install istiod-canary istio/istiod \
	helm install istiod istio/istiod \

	Attach a debug container and you will get the following rules in the `istio-proxy` container:
	Attach a debug container and you can see the nftable rules from the `istio-proxy` container:


		### Upgrade

		The migration of using the existing Istio iptables backend to nftables backend can be done by upgrading Istio. The following example installs an Istio control plane with the iptables backend and a sample application curl in a data plane namespace test-ns.

	The migration of using the existing Istio iptables backend to nftables backend can be done by upgrading Istio. The following example installs an Istio control plane with the iptables backend and a sample application curl in a data plane namespace test-ns.
	The migration from iptables backend to nftables backend can be done by upgrading Istio. The following example installs an Istio control plane with the iptables backend and a sample application in test-ns namespace.

		When you install IstioCNI and Istio resources with Sail Operator, you can create an instance of them with `+spec.values.global.nativeNftables=true+`.
		This feature configures Istio to use the `+nftables+` backend instead of `+iptables+` for traffic redirection.

	When you install IstioCNI and Istio resources with Sail Operator, you can create an instance of them with `+spec.values.global.nativeNftables=true+`.
	This feature configures Istio to use the `+nftables+` backend instead of `+iptables+` for traffic redirection.
	When installing `Istio` and `IstioCNI` resources with the Sail Operator, you can enable nftables by setting `spec.values.global.nativeNftables=true` in the resource. This option configures Istio to use the nftables backend for traffic redirection instead of iptables.


		To enable the native nftables feature, using the following steps:

		[arabic]

	You can find all rules are in the `+inet+` table. The following example installs a sample application `+curl+` in a data plane namespace `+test-ns+`.
	You can find all rules are in the `+inet+` table. The following example installs a sample application `+curl+` in a namespace `+test-ns+` that is part of the mesh.


		When using Sail Operator, the upgraded `IstioCNI` and `Istio` resources `spec.version` value need to be different from the prior instances. Otherwise, the appended `spec.values` will not be configured.

		===== Upgrade with Sail Operator on OpenShift

	===== Upgrade with Sail Operator on OpenShift
	===== Upgrade using Sail Operator


		===== Upgrade with Sail Operator on OpenShift

		To upgrade an iptable based Istio service mesh, using the following steps:


		=== Installation

		The support for native nftables in Istio sidecar mode was implemented in the upstream istio https://github.com/istio/istio/blob/master/releasenotes/notes/nftables-sidecar.yaml[release-1.27].


		==== Install in Ambient Mode

		The support for native nftables in Istio ambient mode was implemented in the upstream istio `+release-1.28+`.

	. Enable nftables by setting `spec.values.global.nativeNftables=true` in the `+Istio+` and `+IstioCNI+` resources. You can find the same example manifests in the Installation section above.
	. Enable nftables by setting `spec.values.global.nativeNftables=true` in the `+Istio+` and `+IstioCNI+` resources. You can find the sample manifests in the Installation section above.

	. Update the data plane namespace `+test-ns+` by restarting all deployments. For example,
	. Update the data plane by restarting the application workloads that are part of the mesh. For example,


		==== Upgrade in Ambient mode

		. Enable nftables with `+ambient+` profile by setting `spec.values.global.nativeNftables=true` in the `+Istio+` and `+IstioCNI+` resources. You can find the same example manifests in the Installation section above.

	. If you get the following IstioCNI log message like `To complete migration to nftables, reboot the node`, reboot each node. You don't need restarting application deployment pods because the Reconcile flag was enabled in Ambient mode IstioCNI.
	. Restart the cluster nodes to complete the migration from iptables backend to nftables backend.

Conversation

yxun commented Aug 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Aug 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

yxun commented Aug 15, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sridhargaddam left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yxun commented Oct 1, 2025

Uh oh!

yxun commented Oct 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sridhargaddam commented Oct 16, 2025

Uh oh!

yxun commented Oct 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yxun commented Nov 7, 2025

Uh oh!

yxun commented Nov 7, 2025

Uh oh!

yxun commented Aug 15, 2025 •

edited

Loading

codecov bot commented Aug 15, 2025 •

edited

Loading

sridhargaddam left a comment •

edited

Loading

yxun commented Oct 8, 2025 •

edited

Loading

yxun commented Oct 20, 2025 •

edited

Loading