https://istio.io/latest/docs/ambient/install/platform-prerequisites/#google-kubernetes-engine-gke describes how when installing istio in ambient mode, the node agent and ztunnel should either be installed into the kube-system namespace which has a ResourceQuota for the node-critical class, or a namespace where such a ResourceQuota has manually been created. But as of istio 1.26, the install automatically creates a ResourceQuota in the istio-system namespace. So istioctl install --set profile=ambient works seamlessly now on GKE (at least it did for me!) whereas I had to create the ResourceQuota myself in earlier releases. I think this section of the docs could be updated to point this out.