enable ISTIO_META_ENABLE_HBONE by default

General MR

Summary

Adds required setting for mixed-mesh (ambient / sidecar) communication which is important during upgrade processes for rolling updates.

Relevant logs/screenshots

Linked Issue

issue

Upgrade Notices

istiod now sets ISTIO_META_ENABLE_HBONE=true on the Istio proxy via meshConfig.defaultConfig.proxyMetadata by default. This enables HBONE on sidecar proxies so sidecar workloads can communicate with ambient (ztunnel) workloads which is recommended during a migration to ambient.

Because ISTIO_META_ENABLE_HBONE is set as an environment variable, existing sidecar-injected pods (and Istio gateways) will have to be restarted to receive the updated ISTIO_META_ENABLE_HBONE setting.

Note

A pod restart is only recommended if you are preparing to upgrade to ambient and do not anticipate the pod would otherwise be restarted due to other more natural circumstances (e.g. updates to packages).

If for some reason you do not wish to enable this functionality you can explicitly disable the feature by adding these values:

istiod:
  values:
    upstream:
      meshConfig:
        defaultConfig:
          proxyMetadata:
            ISTIO_META_ENABLE_HBONE: "false"