Istio Today and Tomorrow: Sidecars and Beyond
summary
Istio now offers an ambient sidecarless topology that runs a per-node ztunnel for multi-tenant L4 mTLS and optional per-service-account Waypoint proxy for L7, using HTTP/2 CONNECT tunnels (EdgeBone) often on port 15008. Install with one istioctl ambient profile command and label a namespace to opt in; it cuts CPU/memory from sidecars, reduces exposure to Envoy L7 CVEs (about two thirds of reported CVEs), is experimental today and targets Alpha in H1 2023.
AI-written summary · about
chapters (12)
- 0:00Start
- 1:35Service Mesh Usage
- 5:04Day 2 Operations
- 9:30Challenges With Sidecars - Transparency
- 11:19Challenges With Sidecars - Incremental Adoption
- 13:44What is Istio Ambient Mesh?
- 15:56Sidecar & Sidecarless Co-exist!
- 16:37Install Ambient
- 18:02Ambient Architecture - Two Layers
- 18:47Ambient Architecture - Secure Overlay Layer
- 20:52Ambient Architecture - L7 Processing Layer
- 23:14Security
related talks
42mThe Current and Future State of Istio
39mThe Future of Service Mesh
48mIstio Ambient Mesh deep dive
44mA Guided Tour of ISTIO Ambient Mesh
30mEmbracing the Future: The Effortless Mutual TLS and Traffic Control Without Sidecars
30mFrom Sidecar to Ambient: Understanding the Evolution of the Service Mesh with Istio
35mIstio: The Past, Present and Future of the Project and Communi...
01h 27mGetting Started with Istio Ambient Mesh