The Complexity of Modern Kubernetes Networking
Kubernetes has transformed how teams build and scale applications, but it has also introduced new layers of complexity. Platform and DevOps teams must now integrate and manage multiple technologies: CNI, ingress and egress gateways, service mesh, and more across increasingly large and dynamic environments. As more applications are deployed into Kubernetes clusters, the operational burden on these teams continues to grow, especially when maintaining performance, reliability, security, and observability across diverse workloads.
To address this complexity and tool sprawl, Tigera is incorporating Istio’s Ambient Service Mesh directly into the Calico Unified Network Security Platform. Service mesh has become the preferred solution for application-level networking, particularly in environments with a large number of services or highly regulated workloads. Among available service meshes, Istio stands out as the most popular and widely adopted, supported by a thriving open-source community. By leveraging the lightweight, sidecarless design of Istio Ambient Mode, Calico delivers all the benefits of service mesh, secure service-to-service communication, mTLS authentication, fine-grained authorization, traffic management, and observability, without the burden of sidecars.
Complementing this addition is Calico AI. Calico AI brings intelligence and automation to Kubernetes networking. It addresses the massive operational burden on teams by allowing them to interrogate complex network data and configurations using simple, natural language.It empowers teams to troubleshoot faster, detect anomalies, and optimize configurations using natural language prompts. Together, Calico AI and Istio Ambient Mode will help Kubernetes teams streamline operations, unify their toolchains, and manage complex Kubernetes environments with greater efficiency and confidence.
Introducing Istio Ambient Mode in Calico
Service mesh is critical for managing service level traffic, security, and observability. However, deploying and managing a separate service mesh results in an operational burden on platform teams. Tigera tackles this operational challenge head-on by including Istio Ambient Mode, bringing a new level of efficiency to service mesh deployments.
Istio Ambient Mode’s sidecarless design provides built-in encryption, authentication, authorization, fine-grained L7 traffic control right within the Calico platform. As a result, platform teams can easily enable essential capabilities like mTLS, workload identity enforcement, and advanced L7 traffic controls (such as routing rules, retries, failovers, and fault injection) without the considerable operational overhead associated with thousands of individual sidecars.
Deep Dive: What is Istio Ambient Mode for Calico?
Calico is adding an enterprise-hardened 100% upstream distribution of Istio Ambient Mode into Calico. Istio Ambient Mode is a lightweight, sidecarless service mesh that provides built-in encryption, authentication, authorization, and L7 traffic control, which can now be managed through the Tigera Operator. Unlike service meshes that deploy a sidecar proxy with every pod, Istio Ambient Mode introduces a shared data plane that uses Istio’s ztunnel and waypoint proxies. This design dramatically reduces compute overhead, speeds up deployment, and simplifies operations.
By incorporating Istio Ambient Mode directly into Calico’s operator-managed architecture, Tigera eliminates the need for manual service mesh configuration and ensures seamless compatibility with leading Kubernetes platforms (GKE, EKS, AKS, Rancher, Openshift, and more).
✨The result: a secure, scalable, and intelligent service mesh that works out of the box.
Key Features and Benefits
1. Simplified, Sidecarless Architecture
Traditional service meshes require using thousands of sidecars, one per pod, increasing resource consumption, latency, and maintenance complexity. Calico Istio Ambient Mode replaces that model with a zero-sidecar architecture, allowing workloads to join the mesh with a simple namespace label:
kubectl label namespace default istio.io/istio-data plane=ambient
This streamlined side-carless approach reduces compute and memory overhead, accelerates rollouts and upgrades, and simplifies troubleshooting. Platform teams no longer need to manage sidecar injection failures or version drift, enabling faster innovation and more predictable performance.
2. Fully Compatible with Calico and Kubernetes Network Policies
In Istio Ambient Mode, when an application sends network traffic, that traffic first gets routed through a secure tunnel that uses port 15008. After going through the tunnel, the traffic continues on to wherever it was originally meant to go. The problem is that Calico or Kubernetes network security rules can only allow or block traffic based on that tunnel port (15008), not the application’s real destination.
With Calico Istio Ambient Mode, the ztunnel component is enhanced so that your existing Calico or Kubernetes security rules still work as expected. This means you don’t have to add special exceptions or open port 15008, your current network policies continue to apply normally.
3. Built-In L7 encryption with mTLS Everywhere
With Istio Ambient Mode, mutual TLS (mTLS) becomes a default capability, providing encryption in transit for all service-to-service communication. And it also ensures that workloads automatically inherit secure identities and policy controls through Istio’s ztunnel layer.
Security engineers will be able to enforce fine-grained access control at both L4 and L7 using Istio’s native AuthorizationPolicy resources that will be fully compatible with Calico’s GlobalNetworkPolicy model. Note: this capability should be available early next year, and will bring network-layer security and application-layer security under one platform, aligning with zero-trust best practices and compliance requirements.
4. L7 Observability and Visibility
Istio Ambient Mode brings deep application-layer observability to the Calico platform. Information from OpenTelemetry that is used by Istio Ambient Mode can automatically be used with Calico, providing a single-pane-of-glass view for troubleshooting latency, network errors, or L7 policy violations. Operators can easily identify which traffic flows are encrypted, which services are underperforming, and where bottlenecks exist.
✅ This enhanced L7 visibility coupled with Calico’s L3/L4 visibility helps teams maintain reliability and performance in dynamic Kubernetes environments, and quickly troubleshoot issues.
5. Operator-Managed Simplicity and Automation
Deploying and managing a service mesh can be daunting, but not with Calico. The Tigera Operator fully automates the provisioning, configuration, and lifecycle management of Istio Ambient Mode.
The Tigera Operator installs all dependencies, configures network policies, and ensures cloud compatibility. It even handles automatic cleanup when the Istio Ambient Mode resource is deleted, removing complexity from Day 2 operations.
✅ This automation not only saves time but ensures consistent, secure, and repeatable deployments, aligning perfectly with modern GitOps practices.
6. Future-Ready L7 Policy and Tiering
As part of Tigera’s “Unified Platform” vision, Istio Ambient Mode lays the foundation for next-generation L7 policy management. While the initial release of Istio Ambient Mode will leverage Istio’s native L7 network policies, upcoming releases will integrate these directly with Calico’s tiered network policy model.
✅ This future alignment means customers will gain unified control across all layers of security, from network access to application-layer authorization, all managed within a single unified platform.
Availability
The initial release of Istio Ambient Mode for Calico is scheduled for December 2025.
Intelligent and Unified Security for Kubernetes
Istio Ambient Mode marks a major step forward in simplifying and securing Kubernetes networking and network security. This mode delivers lightweight, scalable service mesh capabilities directly within the Calico platform, without sidecars or added complexity. It provides built-in mTLS, workload identity, and fine-grained L7 traffic controls, making it easier to enforce zero-trust principles and manage secure communication between services.
Istio Ambient Mode helps improve a unified platform that seamlessly combines service mesh (ambient mode), CNI, network policies, ingress, and egress capabilities.
The Calico Advantage
Calico’s launch of Istio Ambient Mode delivers a unified platform that combines superior security and operational efficiency. This single, enterprise-hardened solution simplifies your Kubernetes environment while maximizing performance and control.
The result is greater operational efficiency, reduced tool sprawl, stronger security through consistent policy enforcement, and improved visibility across the entire Kubernetes environment, helping teams operate more efficiently and confidently at scale.
The benefits are tailored to the specific needs of your engineering teams:
- For Platform Teams: Less infrastructure to manage and faster, safer deployments.
- For Security Engineers: Consistent policy enforcement and built-in encryption across all workloads.
- For DevOps Teams: Clearer insights, fewer blind spots, and more resilient applications.
Next Steps: See Calico in Action 👇
Book a Demo: Request a personalized demo to experience the latest innovations in resilient networking, traffic visibility, and simplified operations.
Learn More: Read the detailed documentation on the Calico Unified Network Security Platform.
