Empowering Istio Ambient with Any Kubernetes CNIs
summary
Istio 1.21 adds an approach that uses Istio‑CNI to give Ztunnel access to each pod’s network namespace, redirecting traffic from the pod to Ztunnel so TLS and telemetry run without injecting sidecars. Enrollment is a label change, no pod restarts, and NetworkPolicy still applies because packets enter and leave the pod via the tunnel (HBONE) handled on the node. The implementation is tested across major CNIs (Calico, cloud providers) and works in a live demo.
AI-written summary · about
related talks
42mThe Current and Future State of Istio
40mIstio Today and Tomorrow: Sidecars and Beyond
33mCNI or Service Mesh? Comparing Security Policies Across Providers
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
44mA Guided Tour of ISTIO Ambient Mesh
17mIstio 2023 RoadMap Update
32mImplementing Zero Trust in a Kubernetes Cluster with Istio
48mSecuring Kubernetes with Istio