Istio Ambient Mode vs. Ambient Mesh
The terms Istio Ambient Mesh and Istio ambient mode are both terms used to describe a newer Istio architecture using Istio’s ambient mode. “Ambient mode” is the official terminology Istio uses to describe a sidecarless architecture. “Ambient Mesh” is a colloquial term used to describe a service mesh without sidecars.
So what is Istio ambient mode?
Traditional Istio deployments involve injecting sidecar proxies into every pod, which intercept and manage network traffic. However, ambient mode eliminates the need for sidecars, instead relying on a “split proxy” architecture. The traffic management responsibilities are moved to the infrastructure layer, specifically to dedicated Layer 4 and Layer 7 proxies deployed outside of the application pods. This provides better resource efficiency, improved security boundaries, and easier maintenance since sidecars no longer need to be injected and maintained per pod.
This allows for a simplified and more scalable service mesh that reduces the operational complexity of sidecars. This mode retains the core benefits of Istio, such as traffic control, observability, and security, but shifts them to the infrastructure layer to be more transparent to application developers. This mode is particularly beneficial for large-scale environments, offering reduced overhead and improved performance compared to the traditional sidecar-based Istio setup.
However, running without sidecars does reduce the granularity at which controls can be applied. A new NIST standard is available that provides guidance on when to which mode of Istio. NIST SP 800-233: Guidance on the Use of Service Mesh Proxy Models for Cloud-Native Applications, dives into the security implications of alternate service mesh proxy models such as ambient mode (sometimes called “sidecarless” service mesh) that have evolved recently to address performance and resource considerations in certain use cases.