Embracing the Future: The Effortless Mutual TLS and Traffic Control Without Sidecars
summary
Ambient mode for Istio delivers sidecar-less mTLS and Layer‑7 controls by running a per‑node Rust Z tunnel plus optional per‑tenant Waypoint proxies, avoiding pod restarts and heavy sidecar resource use. Demo uses k3d and Kubernetes Gateway API, shows automatic TCP mTLS to observability, HTTP 403 enforced by Waypoint, and a 90/10 traffic shift between review versions. Z tunnel implements node agent in Rust (~500 MB for tens of thousands of pods in tests) and Waypoint isolation gives per‑tenant resilience and reported 20% node size reduction.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:51Problem domain
- 3:18Service mesh evolution
- 5:04Sidecar proxy challenges
- 6:51Ambient mesh design
- 8:17Ambient mesh overview
- 10:47Two-layer architecture
- 12:36Scalability design
- 14:39Ztunnel performance
- 15:44Waypoint proxy
- 17:52Onboarding applications into ambient mesh
- 18:59Cost analysis
- 19:20Demo setup
- 21:05Adding applications to ambient mesh
- 22:47Observability
- 24:32Waypoint policies
- 25:39Traffic control
- 26:41Securing observability
- 28:49Future and summary
related talks
32mEmbracing the Future: The Effortless Mutual TLS and Traffic Control Without Sidecars
42mAmbient Mesh: new sidecar less & faster Istio for zero trust
38mEmbracing the Future: The Effortless Mutual TLS and Rich Layer 7 Authz Policy Without Sid...
42mThe Current and Future State of Istio
44mA Guided Tour of ISTIO Ambient Mesh
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
40mIstio Today and Tomorrow: Sidecars and Beyond- 37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars