# Ambient Mesh Published articles for Ambient Mesh. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Istio Project Announces 2026 Technical Oversight Committee Election Results DevFeed: [Istio Project Announces 2026 Technical Oversight Committee Election Results]() Original publisher: [Read original article]() Author: Craig Box, for the Istio Steering Committee Published: 2026-08-24T00:00:00Z Content type: news Language: en Sources: [Istio]() Topics: [istio](), [Network](), [software-architecture](), [Security](), [Cloud]() Tags: [2026](), [ambient-mesh](), [cloud-native](), [community](), [election](), [governance](), [istio](), [mesh](), [microservices](), [networking](), [performance](), [security](), [services](), [technical-leadership](), [toc]() ### AI overview The Istio project announces the results of its 2026 Technical Oversight Committee election. Three incumbent members were re-elected to two-year terms, providing continuity for the project's technical leadership and ongoing development of ambient mesh for cloud-native networking. ### Source excerpt Under the governance system introduced in 2024 for the Technical Oversight Committee (TOC), the Istio project holds annual elections for three of the six seats. This ensures continuous technical leadership while maintaining community-driven momentum. This year's election saw four candidates stand for the three available two-year terms. Following the conclusion of the voting process by the Steering Committee, we are pleased to announce that three incumbents have been re-elected to serve another term on the Istio TOC: Keith Mattix John Howard Mitch Connors Each of these returning members has contributed significantly to the architectural direction, security model, and performance of Istio. Their ongoing tenure provides valuable continuity as the project continues to advance ambient mesh as the standard for cloud native networking. We extend our sincere gratitude to all four candidates who stepped forward. Having competitive elections with strong nominees across the community reflects the health, active engagement, and collaborative spirit of the Istio ecosystem. On behalf of the entire Istio community, the Steering Committee congratulates our re-elected TOC members and thanks everyone who participated in the nomination and voting process. ## Istio at KubeCon Europe 2026: Let's Connect in Amsterdam! DevFeed: [Istio at KubeCon Europe 2026: Let's Connect in Amsterdam!]() Original publisher: [Read original article]() Author: Francisco Herrera, for the Istio Community Published: 2026-02-23T00:00:00Z Content type: article Language: en Sources: [Istio]() Topics: [istio](), [service-mesh](), [Kubernetes](), [ingress-nginx](), [migration](), [Inference](), [model-serving](), [Network]() Tags: [ai-inference](), [ambient-mesh](), [cloudnativecon](), [cncf](), [conference](), [inference](), [ingress-nginx](), [istio](), [istio-day](), [kubecon](), [kubernetes](), [maintainers](), [mesh](), [microservices](), [migration](), [services]() ### AI overview Istio's agenda for KubeCon + CloudNativeCon Europe 2026 includes sessions on running Istio in production, migrating from ingress-nginx, ambient mesh, AI inference serving, multicluster networking, encryption, and community leadership. ### Source excerpt Get ready for a packed agenda of Istio activities at KubeCon + CloudNativeCon Europe 2026, including Cloud Native Theater Istio sessions featuring amazing speakers, hands-on experiences, and chances to meet maintainers and fellow community members in person. Istio highlights at KubeCon EU 2026 Join us at Cloud Native Theater on Tuesday, March 24, 2026 starting at 14:30 CET for 4 amazing Istio Day sessions: Tales From the Mesh: Horrors and Successes of Running Istio in Production -- A panel where real users of Istio share real world experiences, challenges, and wins with Istio service mesh. Zero-Downtime Migration from ingress-nginx to Istio in a Multi-Cluster Kubernetes Platform at Bloomberg -- Learn how Bloomberg migrated to Istio across multiple clusters without downtime. The Good, The Ugly, and The Bad: Leaving Sidecars Behind with Istio Ambient Mesh -- An honest look at migrating to ambient mesh architecture. Running State of the Art Inference with Istio and LLM-D -- Discover how Istio enables efficient AI inference serving. Join the Maintainer Track: Evolution or Revolution: Istio as the Network Platform for Cloud Native -- two maintainers explore how Istio's vision of a universal dataplane has guided the project's evolution, from powering global multicluster connectivity to enabling AI inference. Learn how you can contribute as an "Istio power user contributor" and share feedback on future improvements. Participate in the Cloud Native Novice Track: From First Contribution to Leadership: Lessons on Becoming a CNCF Leader -- a perfect session for newcomers interested in growing within the ecosystem. Learn about overcoming early challenges, maintaining momentum in large communities, and how authenticity, curiosity, and community support can accelerate your journey to leadership. Recommended Sessions at KubeCon Here are recommended sessions from the main conference with strong Istio relevance: From NLB Sprawl To Mesh Efficiency: How Skyscanner Handles 60M Requests Per M ## Istio at KubeCon + CloudNativeCon North America 2025: A Week of Momentum, Community, and Milestones DevFeed: [Istio at KubeCon + CloudNativeCon North America 2025: A Week of Momentum, Community, and Milestones]() Original publisher: [Read original article]() Author: Faseela K, for the Istio Steering Committee Published: 2025-11-25T00:00:00Z Content type: news Language: en Sources: [Istio]() Topics: [istio](), [service-mesh](), [Cloud Native Ecosystem](), [observability](), [Security](), [autoscaling](), [Artificial Intelligence](), [API](), [migration]() Tags: [2025](), [ai](), [ambient-mesh](), [api](), [autoscaling](), [cloud-native-ecosystem](), [cloudnativecon](), [community](), [conference](), [distributed](), [gateway](), [gateway-api](), [istio](), [istio-day](), [kubecon](), [kubecon-na](), [mesh](), [microservices](), [multicluster](), [observability](), [open-source](), [security](), [service-mesh](), [services]() ### AI overview A report on Istio's presence at KubeCon + CloudNativeCon North America 2025, covering Istio Day sessions on service-mesh evolution, AI-ready infrastructure, multicluster Ambient Mesh, validation tooling, autoscaling, and stateful workloads. ### Source excerpt Istio at KubeCon NA 2025 KubeCon + CloudNativeCon North America 2025 lit up Atlanta from November 10-13, bringing together one of the largest gatherings of open-source practitioners, platform engineers, and maintainers across the cloud native ecosystem. For the Istio community, the week was defined by packed rooms, long hallway conversations, and a genuine sense of shared progress across service mesh, Gateway API, security, and AI-driven platforms. Before the main conference began, the community kicked things off with Istio Day on November 10, a colocated event filled with deep technical sessions, migration stories, and future-looking discussions that set the tone for the rest of the week. Istio Day at KubeCon NA Istio Day brought together practitioners, contributors, and adopters for an afternoon of learning, sharing, and open conversations about where service mesh--and Istio--are headed next. IstioDay: North America Istio Day opened with Welcome + Opening Remarks from John Howard from Solo.io and Keith Mattix from Microsoft, setting the tone for an afternoon focused on real-world mesh evolution and the growing energy across the Istio community. The day quickly moved into applied AI with Is Your Service Mesh AI Ready?, where John Howard explored how traffic management, security, and observability shape production-grade AI workloads. IstioDay: Is Your Service Mesh AI Ready Momentum continued with Istio Ambient Goes Multicluster as Jackie Maertens and Steven Jin Xuan from Microsoft demonstrated how Ambient Mesh behaves across distributed clusters--highlighting identity, connectivity, and operational simplifications in multi-cluster deployments. A burst of energy came with the lightning talk Validating Your Istio Setups? The Tests Are Already Written, where Francisco Herrera Lira from Red Hat showed how built-in validation tooling can catch common configuration issues before they reach production. In Optimizing Istio Autoscaling: From Resource-Centric to Connection-Aware ## Maturing Istio Ambient: Compatibility Across Various Kubernetes Providers and CNIs DevFeed: [Maturing Istio Ambient: Compatibility Across Various Kubernetes Providers and CNIs]() Original publisher: [Read original article]() Author: Ben Leggett (Solo.io), Yuval Kohavi (Solo.io), Lin Sun (Solo.io) Published: 2024-01-29T00:00:00Z Content type: article Language: en Sources: [Istio]() Topics: [istio](), [service-mesh](), [Kubernetes](), [Network](), [Cilium](), [Amazon Elastic Kubernetes Service]() Tags: [amazon-eks](), [ambient](), [ambient-mesh](), [cilium](), [cni](), [istio](), [kubernetes](), [mesh](), [microservices](), [networking](), [services](), [traffic](), [ztunnel]() ### AI overview This article explains how Istio Ambient's traffic redirection mechanism was changed to improve compatibility with Kubernetes providers and third-party CNIs. It discusses support for environments including Cilium, Calico, OpenShift, Amazon EKS, Minikube, and Docker Desktop, and describes upstreaming the changes to help Ambient reach beta. ### Source excerpt The Istio project announced ambient mesh - its new sidecar-less dataplane mode in 2022, and released an alpha implementation in early 2023. Our alpha was focused on proving out the value of the ambient data plane mode under limited configurations and environments. However, the conditions were quite limited. Ambient mode relies on transparently redirecting traffic between workload pods and ztunnel, and the initial mechanism we used to do that conflicted with several categories of 3rd-party Container Networking Interface (CNI) implementations. Through GitHub issues and Slack discussions, we heard our users wanted to be able to use ambient mode in minikube and Docker Desktop, with CNI implementations like Cilium and Calico, and on services that ship in-house CNI implementations like OpenShift and Amazon EKS. Getting broad support for Kubernetes anywhere has become the No. 1 requirement for ambient mesh moving to beta -- people have come to expect Istio to work on any Kubernetes platform and with any CNI implementation. After all, ambient wouldn't be ambient without being all around you! At Solo, we've been integrating ambient mode into our Gloo Mesh product, and came up with an innovative solution to this problem. We decided to upstream our changes in late 2023 to help ambient reach beta faster, so more users can operate ambient in Istio 1.21 or newer, and enjoy the benefits of ambient sidecar-less mesh in their platforms regardless of their existing or preferred CNI implementation. How did we get here? Service meshes and CNIs: it's complicated Istio is a service mesh, and all service meshes by strict definition are not CNI implementations - service meshes require a spec-compliant, primary CNI implementation to be present in every Kubernetes cluster, and rest on top of that. This primary CNI implementation may be provided by your cloud provider (AKS, GKE, and EKS all ship their own), or by third-party CNI implementations like Calico and Cilium. Some service meshes may a ## IstioCon China 2023 wrap-up DevFeed: [IstioCon China 2023 wrap-up]() Original publisher: [Read original article]() Author: IstioCon China 2023 Program Committee Published: 2023-09-29T00:00:00Z Content type: article Language: en Sources: [Istio]() Topics: [istio](), [service-mesh](), [eBPF](), [Kernel](), [Open Source](), [Latency](), [Network](), [software-architecture]() Tags: [alibaba](), [ambient](), [ambient-mesh](), [cloudnativecon](), [cncf](), [conference](), [huawei](), [intel](), [istio](), [istio-day](), [istiocon](), [kubecon](), [maintainers](), [mesh](), [microservices](), [network](), [open-source](), [services]() ### AI overview A recap of IstioCon China 2023 in Shanghai, covering the event program, the focus on Istio ambient mesh, and talks about ambient and sidecar coexistence, eBPF-based data planes, traffic redirection, and Istio development. ### Source excerpt It's great to be able to safely get together in person again. After two years of only running virtual events, we have filled the calendar for 2023. Istio Day Europe was held in April, and Istio Day North America is coming this November. IstioCon is committed to the industry-leading service mesh that provides a platform to explore insights gained from real-world Istio deployments, engage in interactive hands-on activities, and connect with maintainers across the entire Istio ecosystem. Alongside our virtual IstioCon 2023 event, IstioCon China 2023 was held on September 26 in Shanghai, China. Part of the KubeCon + CloudNativeCon + Open Source Summit China, the event was arranged and hosted by the Istio maintainers and the CNCF. We were very proud to have a strong program for IstioCon in Shanghai and pleased to bring together members of the Chinese Istio community. The event was a testament to Istio's immense popularity in the Asia-Pacific ecosystem. IstioCon China 2023 IstioCon China kicked off with an opening keynote from Program Committee members Jimmy Song and Zhonghu Xu. The event was packed with great content, ranging from new features to end user talks, with major focus on the new Istio ambient mesh. IstioCon China 2023, Welcome The welcome speech was followed by a sponsored keynote from Justin Pettit from Google, on "Istio Ambient Mesh as a Managed Infrastructure" which highlighted the importance and priority of the ambient model in the Istio community, especially for our top supporters like Google Cloud. IstioCon China 2023, Google Cloud Sponsored Keynote Perfectly placed after the keynote, Huailong Zhang from Intel and Yuxing Zeng from Alibaba discussed configurations for the co-existence of Ambient and Sidecar: a very relevant topic for existing users who want to experiment with the new ambient model. IstioCon China 2023, Deep Dive into Istio Network Flows and Configurations for the co-existence of Ambient and Sidecar Huawei's new Istio data plane based on e ## Announcing Istio's graduation within the CNCF DevFeed: [Announcing Istio's graduation within the CNCF]() Original publisher: [Read original article]() Author: Craig Box, for the Istio Steering Committee Published: 2023-07-12T00:00:00Z Content type: news Language: en Sources: [Istio]() Topics: [istio](), [service-mesh](), [Cloud Native Ecosystem](), [Open Source](), [Cloud](), [Kubernetes](), [Deployment]() Tags: [ambient-mesh](), [announcement](), [cloud-native](), [cncf](), [deployment](), [google](), [graduation](), [ibm](), [intel](), [istio](), [kubernetes](), [mesh](), [microservices](), [microsoft](), [open-source](), [red-hat](), [services]() ### AI overview Istio has graduated within the Cloud Native Computing Foundation after six years of development and collaboration. The announcement also covers ambient mesh progress, upcoming Kubernetes support, and continued community activity. ### Source excerpt We are delighted to announce that Istio is now a graduated Cloud Native Computing Foundation (CNCF) project. We would like to thank our TOC sponsors Emily Fox and Nikhita Raghunath, and everyone who has collaborated over the past six years on Istio's design, development, and deployment. As before, project work continues uninterrupted. We were excited to bring ambient mesh to Alpha in Istio 1.18 and are continuing to drive it to production readiness. Sidecar deployments remain the recommended method of using Istio, and our 1.19 release will support a new sidecar container feature in Alpha in Kubernetes 1.28. We have been delighted to welcome Microsoft to our community after their decision to archive the Open Service Mesh project and collaborate together on Istio. As the third most active CNCF project in terms of PRs, and with support from over 20 vendors and dozens of contributing companies, there is simply no better choice for a service mesh. We would like to invite the Istio community to submit a talk to the upcoming virtual IstioCon 2023, the companion full day, in-person event co-located with KubeCon China in Shanghai, or Istio Day co-located with KubeCon NA in Chicago. Watch a video In this video for Techstrong TV, I talk about the history of the project, and what graduation means to us. Words of support from our alumni When we announced our incubation, we mentioned that the journey began with Istio's inception in 2016. One of the great things about collaborative open source projects is that people come and go from employers, but their affiliation with a project can remain. Some of our original contributors founded companies based on Istio; some moved to other companies that support it; and some are still working on it at Google or IBM, six years later. The announcement from the CNCF and blog posts from Intel, Red Hat, Solo.io, Tetrate, VMware and DaoCloud summarize the thoughts and feelings of those working on the project today. We also reached out to some cont ## Introducing Rust-Based Ztunnel for Istio Ambient Service Mesh DevFeed: [Introducing Rust-Based Ztunnel for Istio Ambient Service Mesh]() Original publisher: [Read original article]() Author: Lin Sun (Solo.io), John Howard (Google) Published: 2023-02-28T00:00:00Z Content type: article Language: en Sources: [Istio]() Topics: [istio](), [service-mesh](), [Rust](), [proxy](), [telemetry](), [Authentication](), [Authorization](), [control-plane](), [Kubernetes](), [TLS (Transport Layer Security)](), [debugging](), [Load Balancing]() Tags: [ambient](), [ambient-mesh](), [authentication](), [authorization](), [control-plane](), [debugging](), [istio](), [kubernetes](), [load-balancing](), [mesh](), [microservices](), [proxy](), [rust](), [service-mesh](), [services](), [telemetry](), [tls](), [ztunnel]() ### AI overview This article introduces ztunnel, a Rust-based per-node proxy for Istio Ambient Mesh. It explains how ztunnel provides workload authentication, mTLS, L4 authorization, traffic proxying, telemetry, and certificate management while forwarding higher-level functionality to waypoint proxies. ### Source excerpt The ztunnel (zero trust tunnel) component is a purpose-built per-node proxy for Istio ambient mesh. It is responsible for securely connecting and authenticating workloads within ambient mesh. Ztunnel is designed to focus on a small set of features for your workloads in ambient mesh such as mTLS, authentication, L4 authorization and telemetry, without terminating workload HTTP traffic or parsing workload HTTP headers. The ztunnel ensures traffic is efficiently and securely transported to the waypoint proxies, where the full suite of Istio's functionality, such as HTTP telemetry and load balancing, is implemented. Because ztunnel is designed to run on all of your Kubernetes worker nodes, it is critical to keep its resource footprint small. Ztunnel is designed to be an invisible (or "ambient") part of your service mesh with minimal impact on your workloads. Ztunnel architecture Similar to sidecars, ztunnel also serves as an xDS client and CA client: During startup, it securely connects to the Istiod control plane using its service account token. Once the connection from ztunnel to Istiod is established securely using TLS, it starts to fetch xDS configuration as an xDS client. This works similarly to sidecars or gateways or waypoint proxies, except that Istiod recognizes the request from ztunnel and sends the purpose-built xDS configuration for ztunnel, which you will learn more about soon. It also serves as a CA client to manage and provision mTLS certificates on behalf of all co-located workloads it manages. As traffic comes in or goes out, it serves as a core proxy that handles the inbound and outbound traffic (either out-of-mesh plain text or in-mesh HBONE) for all co-located workloads it manages. It provides L4 telemetry (metrics and logs) along with an admin server with debugging information to help you debug ztunnel if needed. Ztunnel architecture Why not reuse Envoy? When Istio ambient service mesh was announced on Sept 7, 2022, the ztunnel was implemented using ## Istio Ambient Service Mesh Merged to Istio's Main Branch DevFeed: [Istio Ambient Service Mesh Merged to Istio's Main Branch]() Original publisher: [Read original article]() Author: John Howard (Google), Lin Sun (Solo.io) Published: 2023-02-28T00:00:00Z Content type: release Language: en Sources: [Istio]() Topics: [istio](), [service-mesh](), [releases](), [software-architecture]() Tags: [ambient](), [ambient-mesh](), [deploy](), [infrastructure](), [istio](), [istioctl](), [mesh](), [microservices](), [releases](), [rust](), [service-mesh](), [services]() ### AI overview Istio ambient service mesh has graduated from an experimental branch and merged into Istio's main branch. The announcement describes changes to ztunnel and waypoint components, including a Rust rewrite, simpler waypoint configuration, new istioctl commands, and policy binding improvements, ahead of planned inclusion in Istio 1.18. ### Source excerpt Istio ambient service mesh was launched in Sept 2022 in an experimental branch, introducing a new data plane mode for Istio without sidecars. Through collaboration with the Istio community, across Google, Solo.io, Microsoft, Intel, Aviatrix, Huawei, IBM and others, we are excited to announce that Istio ambient mesh has graduated from the experimental branch and merged to Istio's main branch! This is a significant milestone for ambient mesh, paving the way for releasing ambient in Istio 1.18 and installing it by default in Istio's future releases. Major Changes from the Initial Launch Ambient mesh is designed for simplified operations, broader application compatibility, and reduced infrastructure cost. The ultimate goal of ambient is to be transparent to your applications and we have made a few changes to make the ztunnel and waypoint components simpler and lightweight. The ztunnel component has been rewritten from the ground up to be fast, secure, and lightweight. Refer to Introducing Rust-Based Ztunnel for Istio Ambient Service Mesh for more information. We made significant changes to simplify waypoint proxy's configuration to improve its debuggability and performance. Refer to Istio Ambient Waypoint Proxy Made Simple for more information. Added the istioctl x waypoint command to help you conveniently deploy waypoint proxies, along with istioctl pc workload to help you view workload information. We gave users the ability to explicitly bind Istio policies such as AuthorizationPolicy to waypoint proxies vs selecting the destination workload. Get involved Follow our getting started guide to try the ambient pre-alpha build today. We'd love to hear from you! To learn more about ambient: Join us in the #ambient and #ambient-dev channel in Istio's slack. Attend the weekly ambient contributor meeting on Wednesdays. Check out the Istio and ztunnel repositories, submit issues or PRs! ## Announcing Istio's acceptance as a CNCF project DevFeed: [Announcing Istio's acceptance as a CNCF project]() Original publisher: [Read original article]() Author: Istio Steering Committee Published: 2022-09-28T00:00:00Z Content type: release Language: en Sources: [Istio]() Topics: [istio](), [Network](), [Deployment]() Tags: [2016](), [ambient-mesh](), [cncf](), [conference](), [deployment](), [development](), [infrastructure](), [istio](), [kubecon](), [mesh](), [microservices](), [project](), [release](), [services](), [steering]() ### AI overview Istio has been accepted as an official incubating CNCF project after the CNCF Technical Oversight Committee approved its application. The project will transfer trademarks and build infrastructure to CNCF ownership while continuing work toward the 1.16 release, ambient mesh production readiness, and community governance. ### Source excerpt We are pleased to share that Istio is now an official incubating CNCF project. In April, Istio applied to become a CNCF project. Today, the TOC announced they have voted to accept our application. This journey began with Istio's inception in 2016. We are grateful for all who have collaborated over the last six years on Istio's design, development, and deployment. We especially appreciate the efforts of TOC sponsor Dave Zolotusky, TAG Network, and the engineering teams at Airbnb, Intuit, Splunk, and WP Engine for sharing their feedback as end users. While project work continues uninterrupted, with the acceptance of Istio, we now will begin the processes of transferring trademarks and build infrastructure to CNCF ownership. We are hard at work on our upcoming 1.16 release, while continuing to collect feedback on ambient mesh and driving it to production readiness. Our project members are currently electing our community representatives to the Steering Committee for the next year. As a CNCF project, we will now be much more visible at KubeCon NA in October. Come to the maintainer session, find us in the project pavilion, or grab an Istio t-shirt at the CNCF Store. Watch our Twitter throughout the conference for more exciting updates! ## Ambient Mode Security Deep Dive DevFeed: [Ambient Mode Security Deep Dive]() Original publisher: [Read original article]() Author: Ethan Jackson (Google), Yuval Kohavi (Solo.io), Justin Pettit (Google), Christian Posta (Solo.io) Published: 2022-09-07T15:00:00Z Content type: article Language: en Sources: [Istio]() Topics: [istio](), [service-mesh](), [Security](), [software-architecture](), [telemetry](), [Vulnerabilities]() Tags: [ambient](), [ambient-mesh](), [deep-dive](), [istio](), [mesh](), [microservices](), [security](), [service-mesh](), [services](), [telemetry](), [vulnerabilities]() ### AI overview An in-depth examination of the security implications of Istio ambient mode, a sidecar-less service-mesh data plane. It explains the layered design, including the secure overlay, ztunnel, waypoint proxies, transport security, routing, telemetry, and mTLS, and compares the model with sidecar deployments. ### Source excerpt We recently announced Istio's new ambient mode, which is a sidecar-less data plane for Istio and the reference implementation of the ambient mesh pattern. As stated in the announcement blog, the top concerns we address with ambient mesh are simplified operations, broader application compatibility, reduced infrastructure costs and improved performance. When designing the ambient data plane, we wanted to carefully balance the concerns around operations, cost, and performance while not sacrificing security or functionality. As the components of ambient mesh run outside of the application pods, the security boundaries have changed - we believe for the better. In this blog, we go into some detail about these changes and how they compare to a sidecar deployment. Layering of ambient mesh data plane To recap, Istio's ambient mode introduces a layered mesh data plane with a secure overlay responsible for transport security and routing, that has the option to add L7 capabilities for namespaces that need them. To understand more, please see the announcement blog and the getting started blog. The secure overlay consists of a node-shared component, the ztunnel, that is responsible for L4 telemetry and mTLS which is deployed as a DaemonSet. The L7 layer of the mesh is provided by waypoint proxies, full L7 Envoy proxies that are deployed per identity/workload type. Some of the core implications of this design include: Separation of application from data plane Components of the secure overlay layer resemble that of a CNI Simplicity of operations is better for security Avoiding multi-tenant L7 proxies Sidecars are still a first-class supported deployment Separation of application and data plane Although the primary goal of ambient mesh is simplifying operations of the service mesh, it does serve to improve security as well. Complexity breeds vulnerabilities and enterprise applications (and their transitive dependencies, libraries, and frameworks) are exceedingly complex and prone to ## Get Started with Istio Ambient Mesh DevFeed: [Get Started with Istio Ambient Mesh]() Original publisher: [Read original article]() Author: Lin Sun (Solo.io), John Howard (Google) Published: 2022-09-07T14:00:00Z Content type: tutorial Language: en Sources: [Istio]() Topics: [Kubernetes](), [service-mesh](), [istio](), [Deployment](), [gateway](), [kubectl](), [Zero Trust](), [Cloud](), [Amazon Web Services](), [Google](), [IO]() Tags: [ambient](), [ambient-mesh](), [aws](), [cloud](), [cluster](), [cni](), [core](), [demo](), [deploy](), [don-t](), [gateway](), [google](), [guide](), [ingress](), [installation](), [istio](), [istiod](), [kubectl](), [kubernetes](), [mesh](), [microservices](), [operations](), [plugin](), [services](), [ztunnel]() ### AI overview A step-by-step tutorial for installing Istio Ambient Mesh on a Kubernetes cluster, deploying applications, and understanding how ambient mode uses Istio CNI and ztunnel components to redirect application traffic. It describes supported setup options, including local kind clusters and Google or AWS Cloud. ### Source excerpt Refer to the latest getting started with ambient mesh doc for updated instructions. Ambient mesh is a new data plane mode for Istio introduced today. Following this getting started guide, you can experience how ambient mesh can simplify your application onboarding, help with ongoing operations, and reduce service mesh infrastructure resource usage. Install Istio with Ambient Mode Download the preview version of Istio with support for ambient mesh. Check out supported environments. We recommend using a Kubernetes cluster that is version 1.21 or newer that has two nodes or more. If you don't have a Kubernetes cluster, you can set up using locally (e.g. using kind as below) or deploy one in Google or AWS Cloud: $ kind create cluster --config=- <) Original publisher: [Read original article]() Author: John Howard (Google), Ethan J. Jackson (Google), Yuval Kohavi (Solo.io), Idit Levine (Solo.io), Justin Pettit (Google), Lin Sun (Solo.io) Published: 2022-09-07T13:00:00Z Content type: release Language: en Sources: [Istio]() Topics: [istio](), [service-mesh](), [software-architecture](), [Zero Trust](), [telemetry]() Tags: [ambient](), [ambient-mesh](), [istio](), [kubernetes](), [mesh](), [microservices](), [services](), [telemetry](), [traffic-management](), [zero-trust]() ### AI overview Istio introduces Ambient Mesh, a dataplane mode that removes the need for per-application sidecar proxies. It is designed to simplify operations, improve application compatibility, reduce infrastructure cost, and retain Istio features such as zero-trust security, telemetry, and traffic management. ### Source excerpt Ambient mode is now generally available! Today, we are excited to introduce "ambient mesh", and its reference implementation: a new Istio data plane mode that's designed for simplified operations, broader application compatibility, and reduced infrastructure cost. Ambient mesh gives users the option to forgo sidecar proxies in favor of a data plane that's integrated into their infrastructure, all while maintaining Istio's core features of zero-trust security, telemetry, and traffic management. We are sharing a preview of ambient mesh with the Istio community that we are working to bring to production readiness in the coming months. Istio and sidecars Since its inception, a defining feature of Istio's architecture has been the use of sidecars - programmable proxies deployed alongside application containers. Sidecars allow operators to reap Istio's benefits, without requiring applications to undergo major surgery and its associated costs. Istio's traditional model deploys Envoy proxies as sidecars within the workloads' pods Although sidecars have significant advantages over refactoring applications, they do not provide a perfect separation between applications and the Istio data plane. This results in a few limitations: Invasiveness - Sidecars must be "injected" into applications by modifying their Kubernetes pod spec and redirecting traffic within the pod. As a result, installing or upgrading sidecars requires restarting the application pod, which can be disruptive for workloads. Underutilization of resources - Since the sidecar proxy is dedicated to its associated workload, the CPU and memory resources must be provisioned for worst case usage of each individual pod. This adds up to large reservations that can lead to underutilization of resources across the cluster. Traffic breaking - Traffic capture and HTTP processing, as typically done by Istio's sidecars, is computationally expensive and can break some applications with non-conformant HTTP implementations. While