Istio Ambient Explained

Chapter 2. Istio Ambient Mesh Architecture

Istio ambient mesh implements a “sidecar-less” architecture that is transparent to the workloads in the mesh. This approach has a number of benefits, such as ease of adoption, improved operations, and more, as discussed in Chapter 1. In this chapter, we’ll dig into the architecture of ambient mesh and understand how the various components work together to provide mesh functionality like resilience, observability, security, and policy enforcement.

The Istio Ambient Mesh Data Plane

The main difference between the current Istio mesh and Istio ambient mesh is the data plane. As the name suggests, the data plane attempts to be completely transparent and fade away “into the network.”

• Istio ambient does not use sidecars

• Istio ambient separates out L4 capabilities from L7

• L4 can be used independently or combined with L7

Applications are not explicitly aware of the ambient data plane and are not injected with a sidecar or init container. No part of the data plane exists within the application pods. Additionally, pods do not need to be restarted or deal with obscure container race conditions that can cause network failures.

In the Istio ambient architecture, the data plane is explicitly separated into two layers: a secure overlay layer that handles L4 and a waypoint proxy layer that handles L7, as shown in Figure 2-1. As mentioned in Chapter 1, you will want to adopt the features of a service mesh incrementally and absorb risk commensurate ...