Experimental Support for ambient on Windows

[keithmattix]

Part of #27893. Ztunnel companion PR is istio/ztunnel#1461

More information to follow in an upcoming IstioDay talk as well as a blog post, but in summary: we've made substantial progress towards support Istio on Windows, and we decided the time is right to share where we are with the community! After discussing with the rest of Istio TOC, we have agreed that a long-lived experimental branch is the best place for this code to live for now as we work towards productionizing it and getting CI set up.

What works:

• in pod traffic redirection (via WFP) for existing pods
• Logging via UDS
• ZDS communication with ztunnel

What doesn't work:

• Host probe exclusion: (there's no iptables on windows, so we need ebpf in order to distinguish between kube-proxy and kublet probes, specifically tc support and helper functions like bpf_skc_lookup_tcp)
• Client src ip preservation: similar to above, the Windows API we're using here proxies via localhost, so the destination app sees all ztunnel traffic as originating from localhost.
• DNS proxying (not tested; WFP can handle this in theory)
• traffic redirection for new pods. With Windows containers today, the CNI is invoked before the pause container is created by containerd, so there's no way for istio-cni to program redirection rules in the netns (it doesn't exist yet). In WS2025, there are some OS level changes that will make this possible, but I have an idea for a workaround that involves injecting an init container that will block main container execution until the istio-cni informer retries enough times to get the pod netns.
• Probably something I'm forgetting

Rough edges

• Need to add node selectors based on OS to a lot of our manifests

I'm opening this PR as a draft for folks to take a look and comment on the diff/approach before merging it into the experimental branch. Feel free to reach out with any questions or concerns. Welcome to Istio, Windows!

[istio-testing]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[keithmattix]

@therealmitchconnors removed one of the files and explained the rest. As for tests @grnmeira is going to iterate on them before we move this into the master branch

[keithmattix]

/test integ-pilot-istiodremote

[grnmeira]

@therealmitchconnors @howardjohn is there anything else we need here to get this branch merged? As @keithmattix mentioned I intend to start working on the tests once we have this in.

[howardjohn]

did not review, approving since its on experimental branch