Keith Mattix II
Keith Mattix II
I will try and look as well
Not stale
Fixes #1423
That's my fault; I removed the hold before he could change it
I think you're probably running into [this logic](https://github.com/istio/istio/blob/0dd4d9e4e4b1e4fa83adca9c9167de69bfaeda9c/pilot/pkg/config/kube/gateway/deploymentcontroller.go#L403). See if explicitly enrolling the gateway deployment in the ambient dataplane mode works
A 404 is likely a filter chain issue. The HBONE is being terminated by ztunnel but whatever ztunnel is sending to the gateway isn't matching any of the filter chains...
I know @jaellio was looking into potentially customizing the names of this and the cacerts secret
Commented on https://github.com/istio/istio/issues/55656
> Allow custom ConfigMap name for CA root cert FWIW, I'd like this functionality but for a different use-case. You may want tenants to pick from a set of revision...
Right for my use-case, we don't want mTLS between tenants. It may be desirable to have the istiods be centrally located (remotely); it'll be good to have the option