Istio 1.24: ambient mode, without sidecars, reaches general availability

2024-11-07 · Publisher : Istio · Domain : Cloud & DevOps

On 7 November 2024, Istio 1.24 declares ambient mode stable: ztunnel, waypoints and APIs reach general availability, 26 months after the 2022 announcement, with a service mesh that needs no sidecars.

### Background On 7 November 2024, the Istio project releases version **1.24** and declares **ambient mode** generally available: the ztunnel, waypoints and APIs are marked *Stable* by Istio's technical oversight committee (TOC). Ambient mesh had been announced in September 2022; the community cites 26 months of work with Solo.io, Google, Microsoft, Intel, Aviatrix, Huawei, IBM and Red Hat. ### Key facts - Ambient mode splits processing into two layers: **ztunnel**, a lightweight shared L4 node proxy (mTLS, L4 authorization, telemetry), and optional L7 **waypoints**, which scale independently of applications. - No sidecar to inject in each pod: adoption becomes incremental, from no mesh to a secure overlay, then to L7. - According to the project, resource savings can exceed 90% in some use cases (vendor claim). - Istio 1.24 supports Kubernetes 1.28 to 1.31 and adds status messages on resources and policy attachment to ServiceEntry. - Server-first protocols work, and a container can no longer bypass the proxy. ### Why it matters Sidecars were the main brake on service mesh adoption: CPU and memory overhead, pods that break at injection, upgrade complexity. Ambient mode tackles all three. For an IT services firm, the architecture calculation changes: a mesh becomes conceivable on smaller or denser clusters. Each L7 use case still needs validating and the real gain must be measured on one's own workloads. ### Takeaway With Istio ambient generally available, the sidecar-less service mesh becomes a production option.

Tags : Kubernetes, Cloud natif, Open Source, Sécurité, Observabilité