Istio Ambient Mode for Calico delivers service mesh connectivity and authentication and encryption without the cost and complexity of sidecars. Strengthen east-west security, reduce operational overhead, and simplify how you secure microservices with a single unified platform.
Book a Demo
Trusted By
Istio Ambient Mode
Calico provides an enterprise-hardened, fully upstream distribution of Istio Ambient Mode, built from source, managed by the Tigera Operator, and supported with Tigera’s enterprise-grade support and CVE protection.
Application Traffic Control and Authorization
Istio Ambient Mode provides rich application (L7) traffic control through shared waypoint proxies, enabling progressive rollouts, A/B testing, and resilience features like circuit breaking and timeouts, all while enforcing fine-grained network policies for secure service communication.
mTLS for East-West Traffic
Automatically authenticate and encrypt all service-to-service communication using mutual TLS (mTLS) at the node(L4) and application layers (L7), ensuring secure east-west traffic without relying on sidecar proxies.
Seamless Policy Compatibility
Calico preserves the original destination ports inside the ztunnels, ensuring existing Kubernetes and Calico network policies continue to work unchanged, and function seamlessly with Istio Ambient Mode, with no policy rewrites required.
Integrated Application (L7) Observability With Calico
Ambient Mode’s waypoint proxies generate rich application (L7) metrics, traces, and logs, giving Calico unified visibility across network flows and application traffic in one platform.
Simple Istio Ambient Mesh Deployment
Calico uses the Tigera Operator to automatically install and manage Istio Ambient Mode, providing service-mesh capabilities without complicated setup or ongoing maintenance.
Why Calico?
Unified network security and observability for all Kubernetes traffic
Single security platform for ingress, egress, intra-cluster, and multi-cluster traffic
Improve efficiency by consolidating multiple tools into one platform
Enhanced scalability with dynamic load balancing, eBPF integration, multi-cloud support, and more