A Packet Eye View of the Istio Ambient Mesh
summary
Sidecarless Istio splits proxy work: a z-tunnel daemonset on each node handles L4 (mTLS tunnels, XDS and CA client) while optional waypoint proxy per namespace does L7. Traffic is captured via CNI/iptable, tunneled with h‑bone multiplexing (HTTP CONNECT headers over one mTLS connection) and can interoperate with sidecars using h‑bone in Envoy 1.16+. Implementation is experimental but a Rust z-tunnel prototype shows lower memory use even with ~20,000 tunnels and latency/telemetry tradeoffs remain under active work.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:06Justin Pettit
- 1:20Challenges With Sidecars - Transparency
- 4:02Ambient Mesh Datapath Goals
- 6:26Traditional Sidecars
- 8:46Ambient Mesh Layers
- 10:48Ambient Mesh Security
related talks
34mIstio's Ambient Mesh: The Real Cost of Sidecar-less Tracing
39mThe evolution of service mesh with eBPF
11mEnvoy Namespaces - Operating an Envoy-based Service Mesh at a Fraction of the Cost
36mFine Grained Mesh Metrics for Better Visibility With Native Performance
08mLightning Talk: A Practical Guide on How to Monitor and Compare Service Mesh...
01mLightning Talk: Golden Rules of Resource Isolation in Istio
28mOptimizing Istio Autoscaling: From Resource-Centric To Connection-Aware
26mSupercharge Kubernetes Networking with Cilium and IPv6