Ambient Mesh

Welcome to Ambient Mesh!

Ambient mesh takes a fresh approach to simplifying the service mesh, with a specific focus on areas of architectural flexibility, security, and performance. With ambient mesh in your environment, you can:

• Simplify operations of the service mesh
• Improve application performance
• Reduce infrastructure costs

Building on the core functionality available in Istio, ambient mesh moves the proxy to the node-level for mTLS and identity. This reduces the number of proxies to manage, slashing service mesh costs by reducing the compute and memory requirements per node.

Security is never a tradeoff that customers need to worry about using ambient mesh. Istio is ready to support your Zero-Trust Security initiative with mTLS enabled by default, and it is never compromised with either sidecar or sidecar-less architectures.

How Does Ambient Mesh Work?

Ambient mesh leverages a new architecture that separates the responsibilities of zero-trust networking and Layer 7 policy handling. This is done with two new components to Istio: ztunnels and waypoint proxies.

• Ztunnels are designed to be fast, secure, and lightweight. Ztunnels are deployed per node on a cluster and enable the most basic service mesh configurations for Layer 4 networking features such as mTLS, telemetry, authentication, and L4 authorizations.
• Waypoint proxies provide Layer 7 mesh networking features such as VirtualService routing, L7 telemetry, and L7 authorizations policies.

These ztunnels and waypoint proxies work in tandem to replace sidecars found in the standard Istio service mesh implementation, delivering up to 90% reduction in overhead.