Istio Ambient Goes Multicluster
Talkat Istio Day North America 2025 · on Monday, 2025-11-10· at 14:10· Building B | Level 4 | B406b-407·
summary
Istio implements an alpha ambient multicluster that connects multiple clusters with the same security, control, and observability as single-cluster ambient by using a multi-primary control plane that pulls config from remote API servers, ZTunnel/Waypoint data planes, and an east-west gateway for cross-cluster entry. It introduces service scope config to control proxy endpoint visibility and a double hbone (outer + inner HBONE) design that verifies identity at the gateway without terminating TLS. Alpha shipped in 1.27, 1.28 adds L7 failover, scale tested to ~30 clusters, and GA is targeted for 1.30 (May 2026). Performance and double-encryption costs remain under investigation.
AI-written summary · about
chapters (12)
- 0:00Ambient multicluster intro
- 1:03Multicluster challenges
- 3:09Service scope config
- 5:58Control plane discovery
- 7:03East-west gateway
- 8:08Double HBONE
- 13:04Reliable multicluster deployments
- 16:57Ambient multicluster summary
- 17:39Sidecar vs ambient multicluster
- 18:45Future work & performance
- 19:27Release timeline
- 20:51Q&A
related talks
17mIstio 2023 RoadMap Update
42mThe Current and Future State of Istio
48mIstio Ambient Mesh deep dive
35mIstio: The Past, Present and Future of the Project and Communi...
46mPanel: Ask Me Anything About Istio Service Mesh
44mA Guided Tour of ISTIO Ambient Mesh
01h 27mGetting Started with Istio Ambient Mesh
23mIntroduction to Ambient Mesh