Istio 1.23 introduces a significant update with its “Ambient Mesh” architecture, marking a departure from traditional sidecar deployments in service meshes. This new approach, now deemed production-ready after extensive experimental phases, eliminates the need for individual sidecars accompanying each application within Kubernetes environments. By reducing the overhead associated with deploying and managing sidecars, the ambient mesh simplifies network operations and potentially decreases latency by streamlining how services communicate. This change will lead to reduced operational costs and improved scalability for Kubernetes deployments using Istio.

The technical implementation of the Ambient Mesh involves a zero-trust architecture that utilizes a daemonset pod, known as a ztunnel, to manage Layer 3 and Layer 4 traffic across the cluster, while Envoy-based Waypoint Proxies handle the more complex Layer 7 traffic. This structure allows a single proxy to manage significant traffic volumes across multiple pods, enhancing resource efficiency. The ambient setup also facilitates simpler and faster updates via rolling updates of daemonsets, avoiding the downtime typically associated with sidecar reassignments.