Tight integration of Ambassador and Istio

Ambassador has an integration with Istio by using an Envoy-Proxy as sidecar. But this is only done to integrate Ambassador with Istio’s mTLS, Prometheus and Jaeger. All other possibilities of Istio are not integrated. So if I have a service which gets called by Ambassador and also in a service to service call then I have to establish some rules (e.g. CiruitBreaker, …) in 2 different places. The first place is Ambassador for ingress traffic and the second place is Istio’s VirtualService and DestinationRule for inner service mesh communication.

Would it be possible to integrate Ambassador with Istio in a way that VirtualService and DestinationRule can also be used by Ambassador?

On the other side I want to use Ambassador for authentication und rate limiting where Istio’s alternatives are not fitting very well.

Is it possible to use a VirtualService with a connection to Ambassador? Something like this:

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: my-service
spec:
  hosts:
  - "*"
  gateways:
  - ambassador
  - mesh

[hendrikhalkow]

I think what we need the ability to route traffic from Ambassador Mappings to Istio VirtualServices instead of Services. Idea for a workaround: Create an internal Istio gateway, route Ambassador traffic to that internal Istio gateway service.

[cindymullins-dw]

The Kubernetes Gateway API (https://istio.io/latest/docs/tasks/traffic-management/ingress/gateway-api/) is currently in alpha and is supported by Ambassador Edge Stack (https://www.getambassador.io/docs/edge-stack/latest/topics/using/gateway-api/). In our view this is the likely path forward to common interoperability. @agill17 , @blhagadorn, @hendrikhalkow , @mikejamesowen @hofmannmich