Embracing the Future: The Effortless Mutual TLS and Traffic Control Without Sidecars
summary
Istio Ambient mode replaces per-pod sidecars with a node-level ztrust tunnel in Rust that upgrades pod-to-pod connections to mTLS and a Waypoint per-namespace Envoy for L7 that enforces routing and auth. Demo shows labeling a live namespace into ambient with no pod restarts, mTLS badges and TCP metrics appear, Waypoint blocks DELETE requests with 405, and an HTTP 90/10 rollout works. Benchmarks claim ~30k RPS tests with only minor median latency impact and up to ~20% cluster size reduction (and large CPU/memory savings).
AI-written summary · about
chapters (16)
- 0:00Mutual TLS and traffic control intro
- 3:10Service mesh challenges
- 7:09Istio ambient mode intro
- 11:27Two-layer ambient architecture
- 13:17Simplifying config and performance
- 15:26User experience and cost benefits
- 18:18Performance vs sidecars
- 19:45Setting up the demo environment
- 23:44Enabling mutual TLS
- 24:27Waypoint proxy deployment
- 26:13Authorization policies
- 26:56Traffic control with Gateway API
- 28:45Securing inter-service traffic
- 29:29Mutual TLS overhead
- 30:54Ambient mode prerequisites
- 31:35Closing remarks
related talks
30mEmbracing the Future: The Effortless Mutual TLS and Traffic Control Without Sidecars
42mAmbient Mesh: new sidecar less & faster Istio for zero trust
38mEmbracing the Future: The Effortless Mutual TLS and Rich Layer 7 Authz Policy Without Sid...
23mIntroduction to Ambient Mesh
37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars- 37mDemystifying Secure Application Communication with Zero Trust and Istio Without Sidecars
31mTrust no one: implementing zero trust security with Ambient Service Mesh
22mIs Istio Ambient Mesh Secure?