Running Mixed Mode Confidently: Balancing Ambient and Sidecars in Istio
As organizations move from testing to deploying Istio, many must support diverse workloads that can't rely only on ambient mode or sidecars. This post covers how to run Istio in mixed mode—using both approaches—for optimal security, performance, and efficiency.
Tetrate 
In our previous posts, we explored how Istio’s ambient mode changes observability, supports multi-cluster deployments, and introduces waypoints as a new option for managing Layer 7 functionality. In this post, we focus on a topic that most platform teams face as they move from evaluation to real deployments: how to run mixed mode confidently.
Not every organization can adopt a single service mesh model across every cluster, workload, and environment. Some workloads require maximum security and fine-grained control. Others need the fastest possible onboarding with minimal operational overhead. Mixed mode deployments, where some clusters or workloads use sidecars and others use ambient, are becoming the practical reality. The question is not whether to use both but how to use them together in a way that is consistent, manageable, and reliable.
Why Mixed Mode Becomes the Default
Sidecars remain a strong choice for mission-critical services that require per-pod policy enforcement, advanced routing, or custom proxy behavior. Ambient mode makes it easier to expand the mesh broadly and apply baseline security without injecting proxies into every pod.
Many large environments include both kinds of workloads. A payments system may need the isolation of sidecars while internal applications can run securely with ambient. As a result, mixed mode becomes the natural deployment model for enterprises scaling service mesh across clusters, regions, and clouds.
Common Mixed-Mode Patterns
Mixed mode is not a single architecture. Teams adopt it in different ways depending on their priorities. Some common patterns include:
- Sidecar clusters for regulated workloads: High-sensitivity applications stay on sidecars to ensure compliance and per-pod security.
- Ambient clusters for broad coverage: Internal-facing or less critical workloads run with ambient to reduce complexity and cost.
- Waypoints where L7 is required: Teams that need routing, request-level authentication, or observability without the overhead of sidecars can add waypoints to ambient clusters.
- Hybrid multi-cluster designs: Some clusters run entirely in sidecar mode and others in ambient, with central policy and management spanning across both.
These approaches allow platform teams to align mesh design with the criticality of services rather than forcing a single model everywhere.
Challenges to Address
Running mixed mode confidently requires careful consideration of several factors:
- Policy consistency: Ensuring that security and routing policies apply uniformly across sidecar and ambient clusters.
- Upgrade strategy: Coordinating proxy and control plane upgrades across two modes of operation.
- Team readiness: Making sure developers and operators understand when and how to use sidecars, ambient, and waypoints.
- Visibility: Designing observability approaches that account for differences between sidecar and ambient telemetry.
These challenges are manageable, but they require deliberate planning.
Best Practices for Confident Mixed Mode
Based on early adoption patterns, several practices can help teams succeed with mixed mode:
- Start with clear boundaries: Define which workloads require sidecars and which can run in ambient.
- Adopt gradually: Use ambient first for less critical services, expanding coverage over time.
- Leverage waypoints selectively: Introduce L7 capabilities in ambient clusters only where needed.
- Keep control unified: Use a single control plane to manage policy and security across both deployment models.
- Plan for evolution: Expect that workloads may shift between sidecars and ambient as requirements change.
By following these practices, teams can balance simplicity and control without overcommitting to one model.
What’s Next
Hybrid mesh is not just a temporary step. It is the operational reality for most organizations adopting Istio at scale. Sidecars and ambient each provide value, and together they allow teams to match mesh capability to the needs of each service.
If you are beginning to evaluate a mixed-mode approach, or want to ensure your mesh design supports both simplicity and control, our Istio Ambient Assessment Advisor can help.
Ready to Assess Your Istio Strategy?
Try the advisor now! Get personalized recommendations for your environment:
Tetrate 
