Istio Service Mesh

Overview

Istio is a service mesh: Envoy proxies intercept all service traffic to provide traffic management, mTLS, and observability with no app changes. Two data-plane models — pick deliberately:

• Sidecar (classic): one Envoy per pod; full L7 everywhere; higher per-pod CPU/mem and injection restart cost.
• Ambient (GA in 1.24): per-node ztunnel does L4 mTLS + L4 auth/telemetry automatically; waypoint proxies add L7 only where deployed. Lower overhead, no injection restarts, but L7 features silently no-op without a waypoint. See Currency.

Quick Reference: Common Tasks