Issue in Istio Integration with Ambassador API gateway

Question

I have Installed Ambassador Api gateway on AWS EKS cluster. It's working as expected. Now I'd like to integrate Istio service mesh.

I'm following the steps given in the ambassador's official documentation. https://www.getambassador.io/docs/edge-stack/latest/howtos/istio/#istio-integration.

But after Istio integration some ambassador pods are keep crashing. At a time only 1 pod shows healthy out of 3.

Note: Istio side car are integrated successfully in all ambassador pods. and I have tried with Ambassador 2.1.1 & 2.1.2. But both has same issue. I'm not able to keep all ambassador pod healthy. My EKS version is v1.19.13-eks

Below are the error:

time="2022-03-02 12:30:17.0687" level=error msg="Post \"http://localhost:8500/_internal/v0/watt?url=http%3A%2F%2Flocalhost%3A9696%2Fsnapshot\": dial tcp 127.0.0.1:8500: connect: connection refused" func=github.com/datawire/ambassador/v2/cmd/entrypoint.notifyWebhookUrl file="/go/cmd/entrypoint/notify.go:124" CMD=entrypoint PID=1 THREAD=/watcher

Please do let me know if the above documentation is not sufficient for Istio integration with Ambassador on AWS EKS

Edit 1: In further investigation I found the issue comes when I tried to integrate Istio with PeerAuthentication STRICT mode. There is no such issue with default (permissive) mode.

But another issue comes when enable the STRICT mode, and now it's failing to connect with redis service

Answer 1

After some investigation and testing I find out the way to integrate Istio with Ambassador with PeerAuthentication STRICT mode.

the fix : update the REDIS_URL env variable with https

from:

REDIS_URL:                    ambassador-redis:6379

to

REDIS_URL:                    https://ambassador-redis:6379