Document istio.io/ingress-use-waypoint for ambient (ingress → service waypoint)

[Kamilu-Nurudeen]

Summary

Please document the Kubernetes Service label istio.io/ingress-use-waypoint for Istio ambient mode.

This was implemented in istio/istio#52985 (merged Oct 2024). Follow-up discussion on that PR notes that this is still missing from istio.io (e.g. comment).

Why this matters

• istio.io/use-waypoint controls whether mesh (east–west) traffic to a Service uses the destination waypoint.
• By default, traffic from an Istio ingress gateway to that Service may not traverse the waypoint unless users opt in.
• istio.io/ingress-use-waypoint (typically true on the Service) opts ingress-originated traffic into the same waypoint path, which affects L7 policy, observability (e.g. waypoint metrics), and the “two-tier gateway” model described in the PR.

Users currently rely on third-party writeups or source diving; official docs would reduce misconfiguration.

Suggested doc updates

1. Resource labels (or equivalent): add istio.io/ingress-use-waypoint with resource type Service, valid values, and relationship to istio.io/use-waypoint.
2. Ambient waypoint / ingress section (e.g. near Configure waypoint proxies or a dedicated “Ingress and waypoints” subsection): explain default bypass vs opt-in, double-L7 considerations, and pointer to ENABLE_INGRESS_WAYPOINT_ROUTING / control-plane behavior as appropriate for the documented Istio version.

References

• Implementation PR: Support sending from ingress -> service waypoint istio#52985
• Feature opt-in: Service label istio.io/ingress-use-waypoint (mirrors istio.io/use-waypoint per PR description).

Thank you.

[Kamilu-Nurudeen]

I’m happy to contribute a docs PR for this if that’s welcome.

[kfaseela]

Feel free to submit a PR