The Future of Service Mesh
summary
Istio Ambient Mesh removes per-pod Envoy sidecars and replaces them with a ztunnel (node-level zero-trust tunnel) for L4 mTLS and waypoint (service-account Envoy proxy) for L7 policies, letting teams onboard by labeling namespaces instead of injecting proxies. It ships as an experimental profile since Istio 1.15 and promises lower CPU/memory cost, fewer upgrade rollouts (patch Waypoints not every pod), reduced latency on L4 paths, and a hands-on workshop/demo showing mixed ambient and sidecar deployments.
AI-written summary · about
chapters (36)
- 0:00Introduction
- 1:05Talk purpose
- 2:32Robot car racing story
- 6:25Parsimony in engineering
- 7:29Service mesh trends
- 7:49Service mesh 2017
- 9:15Death Star analogy
- 10:19Microservice cross-cutting
- 11:01Sidecar injection evolution
- 12:03Data and control planes
- 13:29Control plane policy
- 14:35Traditional mesh ops
- 15:21Mesh adoption complexity
- 15:41Istio deployment ops
- 17:31Transient workloads issues
- 18:35Mesh latency problems
- 19:18Sidecar cost implications
- 20:00Innovations for mesh
- 20:21Istio Ambient Mesh
- 21:04Ambient Mesh benefits
- 21:46Ambient Mesh onboarding
- 22:31Ambient Mesh architecture
- 23:58Z-tunnel and Waypoint
- 25:02Z-tunnel security
- 26:51Waypoint L7 processing
- 28:19Cost and ops reduction
- 29:03Ops benefits at scale
- 30:06Performance improvements
- 31:33Demo and workshop
- 32:40Ambient Mesh summary
- 33:02Community feedback
- 34:27Microsoft joins Istio
- 35:10Q&A
- 37:25Robot car racing Q
- 38:28Ambient Mesh production
- 39:11Closing remarks
related talks
48mIstio Ambient Mesh deep dive
42mThe Current and Future State of Istio
30mFrom Sidecar to Ambient: Understanding the Evolution of the Service Mesh with Istio
23mIntroduction to Ambient Mesh
40mIstio Today and Tomorrow: Sidecars and Beyond
11mIstio Ambient Mesh: Sidecar vs Sidecar-less, Explained Simply
44mA Guided Tour of ISTIO Ambient Mesh
28mService Mesh: Demystifying Istio