Shared CNI and multiple istio control planes

[artyom-p]

We are designing a multi-tenant platform and want to deploy Istiod and IngressGateway per tenant in dedicated namespaces, and have Istio CNI deployed in a shared way in its namespace. Currently, there is no way (?) to specify the CNI namespace when creating an Istio resource. In istiod logs, '--cniNamespace' is set to the same namespace where istiod is deployed. Can it be overridden somehow?

Is there any example how to configure multiple istio control planes / ingress gateways and single shared CNI / z-tunnel ?

[sridhargaddam]

Currently, there is no way (?) to specify the CNI namespace when creating an Istio resource.

You can specify the namespace where you want to install istio-cni while creating the IstioCNI CR.
Istiod just needs to know that CNI is enabled (i.e., values.cni.enabled=true), but does not require the namespace where the CNI daemonSet is deployed.

Is there any example how to configure multiple istio control planes / ingress gateways and single shared CNI / z-tunnel ?

Although the following doc does not use IstioCNI, it gives you some pointers on how to configure multiple control planes in sail operator - https://github.com/istio-ecosystem/sail-operator/tree/main/docs#multiple-meshes-on-a-single-cluster