<p>Hi there I was reviewing the GKE autopilot mode and noticed that in cluster configureation istio is disabled and I'm not able to change it. Also installation via istioctl install fail with following error</p>
<pre><code> error   installer       failed to update resource with server-side apply for obj MutatingWebhookConfiguration//istio-sidecar-injector: mutatingwebhookconfigurations.admissionregistration.k8s.io &quot;istio-sidecar-injector&quot; is forbidden: User &quot;something@example&quot; cannot patch resource &quot;mutatingwebhookconfigurations&quot; in API group &quot;admissionregistration.k8s.io&quot; at the cluster scope: GKEAutopilot authz: cluster scoped resource &quot;mutatingwebhookconfigurations/&quot; is managed and access is denied
</code></pre>
<p>Am I correct or it's not possible to run istio in GKE autopilot mode?</p>

<p><strong>TL;DR</strong></p>
<p>It is not possible at this moment to run istio in GKE autopilot mode.</p>
<p><strong>Conclusion</strong></p>
<p>If you are using Autopilot, you don't need to manage your nodes. You don't have to worry about operations such as updating, scaling or changing the operating system. However, the autopilot has a number of <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview#limits" rel="noreferrer">limitations</a>.</p>
<p>Even if you are trying to install istio with a command <code>istioctl install</code>, istio will not be installed.  You will then see the following message:</p>
<p>This will install the Istio profile into the cluster. Proceed? (y/N) y</p>
<p>✔ Istio core installed<br />
✔ Istiod installed<br />
✘ Ingress gateways encountered an error: failed to wait for resource: resources not ready after 5m0s: timed out waiting for the condition
Deployment/istio-system/istio-ingressgateway</p>
<ul>
<li>Pruning removed resources                                                                                                                                       2021-05-07T08:24:40.974253Z     warn    installer       retrieving resources to prune type admissionregistration.k8s.io/v1beta1, Kind=MutatingWebhookConfiguration: mutatingwebhookconfigurations.admissionregistration.k8s.io is forbidden: User &quot;something@example&quot; cannot list resource &quot;mutatingwebhookconfigurations&quot; in API group &quot;admissionregistration.k8s.io&quot; at the cluster scope: GKEAutopilot authz: cluster scoped resource &quot;mutatingwebhookconfigurations/&quot; is managed and access is denied not found
Error: failed to install manifests: errors occurred during operation</li>
</ul>
<p>This command failed, bacuse for <a href="https://istio.io/latest/docs/setup/additional-setup/sidecar-injection/" rel="noreferrer">sidecar injection</a>, installer tries to create a <em>MutatingWebhookConfiguration</em> called <em>istio-sidecar-injector</em>. This limitation is <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/autopilot-overview#webhooks_limitations" rel="noreferrer">mentioned here</a>.</p>
<p>For more information you can also <a href="https://medium.com/sakajunlabs/running-istio-on-gke-autopilot-707f6de2d43b" rel="noreferrer">read this page</a>.</p>
