Istio deployed but doesn't show in the GKE UI

Question

I have added Istio to an existing GKE cluster. This cluster was initially deployed from the GKE UI with Istio "disabled".

I have deployed Istio from the CLI using kubectl and while everything works fine (istio namespace, pods, services, etc...) and I was able later on to deploy an app with Istio sidecar pods etc..., I wonder why the GKE UI still reports that Istio is disabled on this cluster. This is confusing - in effect, Istio is deployed in the cluster but the UI reports the opposite.

Is that a GKE bug?

Deployed Istio using: kubectl apply -f install/kubernetes/istio-auth.yaml

Deployment code can be seen here:

https://github.com/hassanhamade/istio/blob/master/deploy

Answer 1

Istio will only show as enabled in the GKE cluster UI when using the Istio on GKE addon. If you manually install Istio OSS , the cluster UI will show "disabled".

Answer 2

From my point of view this doesn't look as a bug, I assume that the status is disabled because you have deployed a custom version of Istio on you cluster. This flag should be indicating the status of the GKE managed version.

If you want to update your cluster to use GKE managed version, you can do it as following:

With TLS enforced

gcloud beta container clusters update CLUSTER_NAME \
    --update-addons=Istio=ENABLED --istio-config=auth=MTLS_STRICT

or

With mTLS in permissive mode

gcloud beta container clusters update CLUSTER_NAME \
    --update-addons=Istio=ENABLED --istio-config=auth=MTLS_PERMISSIVE

Check this for more details.

Be careful since you already have deployed Istio, enabling the GKE managed one may cause issues.