►
Description
Don’t miss out! Join us at our upcoming event: KubeCon + CloudNativeCon Europe 2023 in Amsterdam, The Netherlands from April 17-21. Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects.
A Packet Eye View of the Istio Ambient Mesh- Justin Pettit, Google & Lin Sun, Solo.io
While service mesh has been widely adopted in production, many enterprise users have expressed concerns about the intrusive nature of the sidecar pattern, such as breaking certain applications, requiring disruptive upgrades due to CVEs, and often reserving large amounts of unnecessary resources. This talk explores how service meshes can require zero change to the application with a new sidecarless architecture while still providing the common service mesh functions such as security, observability, traffic management, and resiliency. Justin and Lin have worked closely with the Istio maintainers on defining the new Istio mesh sidecarless architecture. We will discuss the new architecture from the packet eye view through live demos and an architectural deep dive, along with how it can interact with workloads using traditional sidecars. You’ll walk away with instructions on how to try this new architecture from Istio on your own!
A
B
Am
Justin
I
am
working
on
istio
for
Google
I've
been
working
on
it
for
about
three
years.
Most
of
the
work
I've
been
doing
for
the
last
couple
has
been
sort
of
in
preparation
for
this
ambient
work.
Prior
to
that
I
used
to
work
on
a
project
called
openv
switch
and
the
ovn.
So
it's
a
little
bit
more
in
the
sdn
world
than
the
service
mesh
so
been
enjoying
what
I've
been
seeing.
So
far,
though,.
A
Also
yeah
I'm
so
excited
because
Justin
and
I
have
been
working
on
istio
ambient
service
match
for
at
least
six
months,
and
also
even
before
that
in
the
istio
community,
Justin
I
believe
you
presented
some
idea
to
you.
It's
your
networking
work
group,
so
that
was
over
a
year
ago,
so
it's
really
cool
to
be
together
with
Justin
I.
Think
some
of
you
know
me
from
early
on,
but
just
real
quickly.
A
I
work
for
solo
I'm,
one
of
the
founding
members
of
the
Israel
Community,
sits
on
a
technical
oversight
and
steering
committee
and
most
exciting
about
me.
Is
it's
your
ambient
I
actually
wrote
a
book
about
istio
ambient
explained
with
Christian.
So
if
you
guys
ask
really
good
question
for
our
session
you're
going
to
get
one
of
our
books,
all
right,
I
like
to
start
talking
about
challenges
with
psychos
today,
the
biggest
challenging
in
my
opinion
is
transparency.
A
So
it
requires
the
injection
of
psycha
right.
How
many
of
you
are
running
startup
or
shutdown
sequence
issue
with
zika
today?
Nobody,
somebody
got
to
be
somebody.
It's
actually
a
lot
of
complaints.
We
heard
from
our
user
in
the
istio
community
and
I'm
sure
it's
all
across
different
service
mesh
projects
too,
and
how
many
of
you
are
not
too
happy.
The
sidecar
upgrades
require
restarting
of
your
application.
A
Yeah,
that's
right
and
how
many
of
you
ever
wanted
to
run
jobs,
kubernetes
jobs,
but
find
out
all
right.
It
doesn't
really
support
jobs
with
the
cycle.
That
was
a
little
bit
frustrating
right
and
what,
if
you
have
silver
sand?
First
protocols,
like
my
sequel
right
how
many
of
you
had
requirements
to
run
those
in
service
mesh?
A
Sorry,
hopefully,
I
didn't
cause
that
yeah.
So
these
are
the
challenges
which
I
with
cycle
right.
You
always
have
to
drag
something
with
you
and
then
it
has
frequent
needs
with
cve
upgrades
and
the
Second
Challenge
I
would
say,
is
incremental
adoption
right,
most
of
user
adopt
service
mesh
because
Mutual
TLs,
but
psycha
doesn't
offer
a
choice.
They
can
just
adopt
service
mesh
just
for
a
fraction
of
the
cycle.
A
They
still
have
to
carry
the
entire
cycle
with
their
application
container,
even
though
they
just
need
one
single
piece
of
the
service
measure,
which
is
typically
Mutual
tis.
It's
really
All
or
Nothing
a
model
with
the
cycle
today
and
the
the
third
thing,
in
my
opinion,
with
psycha,
is
over
provision
of
resources.
Let's
say
you
have
10
replicas
for
your
services
and
each
of
your
10
replicas
always
have
the
psychosis
along
with
them.
A
Even
though
you
may
only
need
three
parts
to
do
the
job,
your
cycle
is
doing
whether
it's
mutual
TLS
or
traffic,
shifting
or
layer
7
processing.
So
you
don't
have
that
choice,
and
you
have
to
always
pay
for
that
cost
of
cycle.
With
that
I'm
going
to
pass
to
Justin
to
talk
about
ambient
service
mesh.
B
Yeah,
so
you
know
with
the
plane
with
Ambien
was
we
wanted
to
address
those
issues?
That
Lynn
was
mentioning
so
sort
of
the
most
important
one
from
at
least
my
point
of
view
was
not
being
disruptive
to
the
applications
so
having
the
the
proxy
be
a
side
car
the
way
that
those
side
cars
are
instantiated,
it
requires
restarting
the
application.
So
you
can't
just
hot
insert
a
service
mesh
into
your
workloads.
B
You
have
to
do
something,
that's
fairly
disruptive
and
because
we're
doing
full,
full
L7
processing,
there's
also
the
chance
that
we
can
break
some
applications
that
have
non-compliant
HTTP
Stacks.
There
is
some
stuff
with
the
way
that
we
do
mtls
upgrade
in
istio.
That
could
cause
some
breakage,
and
so
we
wanted
to
address
those
things
and
then
also
just
when
there
are
cves
that
need
to
be
addressed
in
the
proxy
it
requires.
You
know
if
we
want
to
upgrade
it
requires
restarting
the
workloads
as
well.
B
So
we
wanted
to
be
much
less
disruptive
to
Applications,
as
Lynn
mentioned.
Currently
we
have
to
in
istio
with
sidecars
you
have
to
over
provision
for
the
proxies
you
have
to
for
each
workload.
You
need
to
have
a
proxy
and
allocate
resources
for
worst
case
scenario
for
the
traffic.
That
is
likely
to
be
seen
on
that
particular
application,
which
means
that
that
you
end
up
telling
kubernetes
that
you
need
additional
resources
that
you
end
up,
never
using,
so
that
a
lot
of
it
just
goes
underutilized.
B
We
also
wanted
to
make
sure,
though,
that
you
know
sidecars
still
have
their
place.
There
are
a
number
of
applications
that
require
the
kind
of
the
security
model
or
the
approach
that
sidecars
have,
and
so
we
also
wanted
to
make
sure
that
whatever
we
did
also
continued
to
interoperate
with
sidecars
and
as
Lynn
was
mentioning.
B
We
also
currently
the
way
that
istia
would
work
is
if
you
wanted
just
even
a
feature
like
mtls,
you
had
to
take
all
of
istio
and
all
of
the
complexity
you
needed
sidecars,
you
needed
to
restart
your
applications
and
we
wanted
to
have
a
smooth
path
so
that
sort
of
the
amount
of
work
that
you
had
to
do
was
related
to
or
to
get
it
installed
was
related
to
the
complexity
of
what
you
wanted
to
do.
So
we
wanted
a
smooth
upgrade
path
from
something
relatively
simple,
like
mtls
encryption
to
full
istio.
B
B
So
what
we
wanted
to
do-
or
so
the
approach
that
we
took
with
ambient,
is
that
we
broke
apart
the
the
proxy
into
two
parts
and
then
we
also
are
looking
now
at
providing
policies,
L4
policies
separating
L4
policies
from
L7
policies.
So
at
the
lowest
layer
we
have
The
L4
policies,
which
we
call
the
secure
overlay,
and
so,
instead
of
having
the
sidecars,
we
take
the
the
the
proxy
that
we're
calling
Z
tunnel.
And
we
run
that
as
a
Daemon
set
on
the
Node.
B
B
Now,
once
we
want
to
introduce
L7,
we
still
have
the
Z
tunnels,
nothing
changes
in
the
workloads
themselves,
but
now
we
introduce
a
what
we
call
a
waypoint
proxy
and
that
is
a
full
L7
Envoy
proxy
that
we're
deploying
that
does
everything
that
you
would
normally
expect
istio
to
do,
and
rather
than
make
it
an
all
or
nothing,
we
configure
it
per
namespace
or
per
service
account.
So
let's
say
that
you
had
these
S1
and
S2
workloads
that
you
are
in
one
network
names
or
in
one
sorry
istio
namespace.
B
B
B
Instead,
what
we're
doing
is
we're
opening
a
single
HTTP
connection
and
then
tunneling
all
of
the
traffic
through
that
which
makes
which
cleans
up
a
lot
of
the
the
issues
that
we
were
seeing
with
the
previous
method.
It
also
makes
it
easier
now,
when
we
have
those
Waypoint
proxies,
because
we've
defined
a
standard,
tunneling
mechanism
to
carry
some
of
that
identity.
You
know,
as
traffic
has
to
go
through,
that
you
know
go
out
of
its
way
and
not
just
going
from
workload
to
workload.
B
Thank
you.
So
one
of
the
questions
that
we
get
you
know
the
first
question
that
people
often
ask
about.
This
is
what
the
security
model
is,
because,
obviously
it
looks
a
lot
different
from
the
side
car
where
the
before
you
know
it's
pretty
easy
to
understand
that
the
sidecar
did
everything
and
it's
just
sitting
next
to
the
workload.
But
now
we
have
a
shared
re,
multiple
shared
resources,
so
I
wanted
to
just
briefly
touch
on
this.
We
actually
wrote
A
Blog
when
we
announced
ambient
mesh
it's
available
on
the
istio
website,
if
you're
interested.
B
That
goes
into
a
lot
more
detail
about
how
security
works,
but
there's
sort
of
three
different
levels
that
I
think
of
so
first
is
the
way
that
the
application
interacts
with
the
the
service
mesh
and
so
It's,
actually
an
advantage
now
not
to
have
the
workload
co-located
with
the
the
proxy.
So
previously.
If
there
was
a
vulnerability
in
the
application,
then
that
application
could
actually
attack
the
proxy
and
also
you
know
if
the
application
was
just
misbehaving.
The
current
way
that
we
would
send
traffic
through
the
proxy
is.
B
We
would
just
use
iptables
rules
and
redirect
the
traffic,
but
it
was
pretty
trivial
for
an
application
that
is
misbehaving
to
just
bypass
the
proxy
entirely.
So,
by
moving
the
enforcement
outside
of
the
workload,
we
actually
have
better
protection
than
we
previously
had
another
one
is
the
the
Z
tunnels,
and
so
obviously
there
is
some
concern
that
people
have
when
they
first
hear
about
this
design
about
having
this
z-tunnel
have
the
certificates
of
all
of
the
workloads,
but
we
try
to
mitigate
or
we
mitigate
that
in
a
couple
different
ways.
B
First
of
all,
when
the
workload
requests
the
certificate
or
so
it
so
sorry,
when
a
workload
starts
up,
the
Z
tunnel
notices
that
and
then
it
requests
from
the
ca
for
the
certificate
for
that
workload,
and
then
that
CA
actually
ensures
that
that
workload
is
available.
It
authenticates
the
Z
tunnel
and
then
it
makes
sure
that
that
workload
that
is
being
requested
is
actually
present,
so
that
you
know
not
a
z
tunnel,
can't
just
ask
for
anybody's
certificate.
B
The
other
thing
is
that
the
Z
tunnel
I
mentioned
that
is
just
doing
L4
processing.
So
it
has
a
much
smaller
attack
surface
than
the
full
Envoy
proxies
that
we
were
doing
before
as
sidecars.
So
you
know
when
we
look
at
the
envoy
cves.
Most
of
them
are
related
to
the
L7
processing,
it's
happening,
which
we
are
not
doing
at
all
in
the
in
the
Z
tunnels
and
then
finally,
there
are
the
Waypoint
proxies
which
are
shared,
but
the
way
that
they
we
share
them
are
per
service
account
or
per
namespace.
A
Okay,
great,
thank
you
so
much
Justin
that
was
a
great
overview
of
istio
ambient
service
match.
I'm,
really
excited
about
the
security
stuff.
You
were
just
talking
about
so
a
disclaimer.
We
don't
have
a
live
demo
because
we
actually
have
multiple
live
demo
on
YouTube.
So
if
anybody
wants
to
see
an
ambient
live
demo
just
go
to
the
istio
channel.
A
The
packet
walkthrough,
we're
going
to
have
is
going
to
focus
on
the
pieces
relevant
to
istio,
so
I'm
not
going
to
dive
into
like
kubernetes
networking,
and
you
know
how
the
container
networking
works
just
because
we
don't
have
enough
time
for
the
talk.
So
as
Justin
was
just
mentioned,
Ray,
if
you
just
need
a
mutual
TLS
or
layer
4
functionalities,
you
basically
only
need
a
z-tunnel.
So
what
happens
in
this
case
is
the
the
client
which
is
app
a
in
this
diagram.
A
A
So
when
app
a
is
attempting
to
send
a
request
to
app
B
the
zetano,
we
set
up
traffic
redirections
through
iptable
and
routes,
so
the
request
would
be
captured
by
the
zetano,
that's
co-located
on
the
same
node,
and
then
the
zitano
would
impersonate
as
APPA
and
send
the
request
through
the
h-bone
tunnel.
That
Justin
was
just
mentioned
and
then
to
the
Target
Z
tunnel,
and
then
the
target
is
intelligent
to
forward
the
traffic
to
app
B.
So
that's
how
it
works
at
a
high
level.
So
let's
take
a
dip
into
how
it
works.
A
So
the
first
thing
is,
you
would
need
to
include
your
application
in
ambient
service
mesh
right
else.
We
don't
know
whether
you
want
your
ambient,
your
your
application
part
of
ambient
and
to
do
that.
The
simple
way
to
do
that
is
label
on
the
namespace.
So
for
anything
you
want
to
be
part
of
SEO
ambient
service
mesh.
You
just
simply
label
that
namespace
with
ambient
and
that's
how
we
know
you
want
to
be
part
of
ambient,
so
essentially
in
istio
config
map.
A
There
is
a
ambient
mesh
configuration
by
default
that
configuration
is
namespace,
but
eventually,
when
you
feel
comfortable
about
ambient,
you
want
to
enable
it
for
the
entire
mesh
you
could
enable
it
as
for
the
entire
cluster,
so
that's
also
available,
but
for
now,
let's
do
it
on
the
namespace,
as
people
looking
explore.
Ambient
and
transition
to
ambient,
so
another
key
component
is,
is
still
cni.
A
We
have
expanded
istiocli
to
work
with
ambient,
so
what
it
does
is
the
istiocli
would
do
a
check
to
see
if
the
the
application
is
part
of
the
ambient
based
on
the
namespace
label.
We
just
talked
about,
and
if
it's
part
of
ambient
we
are
going
to
set
up
the
traffic
redirection
to
have
the
Z
tunnel
co-located
with
the
application
pod
to
always
capture
all
the
incoming
and
outgoing
traffic.
A
It's
kind
of
similar
as
the
iptable
setup
with
the
cycle
and
the
application
container
today,
except
we're
doing
it
between
the
application,
pod
and
zetano
co-located
on
the
same
node.
And
if
the
Pod
is
not
the
app
is
not
part
of
ambient.
We
would
essentially
do
nothing,
so
it
would
be
behaved
exact
same
as
you
are
not
part
of
istio
or
ambient
service
mesh.
A
So,
let's
walk
through
how
zetunnel
works
before
you
even
send
any
requests
from
App
a
to
app
B
and
the
moment
you
stand
up
your
part
in
that
particular
namespace
that
you
labeled
as
ambient
sea
tunnel
is
going
to
serve
as
a
XDS
client.
It's
going
to
try
to
get
the
application,
get
get
the
configuration
from
the
istio
control
plan,
so
essentially
what
z-tunnel
is
going
to
send
the
request
to?
Is
your
control
plane
on
15012
and
then
the
istio
control
plane
figure
out?
A
Oh,
you
are
the
Z
tunnel
on
that
particular
node,
and
this
is
your
specific
XDS
config,
because
if
you
are
at
zetano
on
a
different
node,
your
configuration
will
looks
differently
now,
let's
talk
about,
as
you
add,
applications
to
your
namespace
that
has
this
magic
ambient
label.
Zetano
is
also
served
as
a
certificate.
Authority
client.
So
in
this
case,
what
zitender
is
going
to
do
is
zitana
is
going
to
say
hey.
This
is
my
service
account
token
for
Z
tunnel.
A
Now
this
application,
a
is,
can
you
give
me
the
search
of
the
application
is
so
that
I
can
impersonate
application
a
so.
The
istio
control
plan
is
going
to
do
the
check
that
Justin
was
just
mentioned,
whether
the
the
Pod
for
application,
a
is
co-located
on
the
same
Z
tunnel.
That's
sending
the
request
to
see
if
it's
allowed
to
represent
application
a
and
then
send
back
to
say
if
it's
allowed,
hey,
you
are
allowed
to
represent
application.
A
and
here
are
your
search,
so
essentially
at
zetano
on
the
Node
is
multi-tenancy.
A
A
The
next
thing
we
want
to
talk
through
is
how
the
traffic
redirects
right,
so
when
the
application
does
send
a
request
to
from
application
a
to
application
B
on
Port
80
in
this
example,
so
the
connectivity
between
application
A
to
Z
Tunnel
right
now
is
actually
plain
text
in
green.
The
reason
why
it's
plain
text
is
because
we
don't
encrypt
that
that
traffic
at
the
moment
and
the
D
tunnel
would
upgrade
the
connections
through
encrypted
traffic
through
the
edgebone
once
the
traffic
hits
the
zetunda.
A
A
So
now
at
the
moment
the
Z
tunnel
we
talk
about
it-
has
the
search
for
app
a
it.
Also
have
the
right,
XDS
configuration,
so
it
can
think
out.
You
know,
where
is
the
Target?
What
is
the
target
of
the
application
BC
tunnel?
It
needs
to
reach
out
to
you.
So
the
next
thing
we're
going
to
talk
about
is
on
the
source
D
tunnel.
What's
going
to
happen
when
the
packager
arrives
on
the
source
C
tunnel,
so
essentially
The
Source
seed
handle
is
going
to
think
out.
A
What
is
the
destinations
Eternal
based
on
the
XDS
config?
We
just
talk
about
how
it
gets
the
XCS
config
and
then
from
there
it's
going
to
try
to
figure
out.
Is
there
an
existing
h-bone
tunnel
between
application,
a
and
application
B
service
account
pail
it's
trying
to
reach
from
this
particular
source
and
a
targeted
Zee
tunnel.
If
it
is
yes,
let's
go
ahead,
reuse
the
existing
tunnel,
maybe
more
efficient,
and
then,
if
there's
no
existing
power,
it
would
create
the
new
channel.
A
So
if
you
record
a
h-bone
slide
that
Justin
talk
about
this
is
the
edgepoint
tunnel
and
the
logic
trying
to
decide
whether
to
reuse
now,
as
as
we
figure
out
where
the
destination
is
and
think
out,
whether
to
establish
the
edge
bone
tunnel
as
the
package
is
reaching
out
to
the
destination
Z
tunnel.
So
by
the
way
this
traffic
is
encrypted.
It's
mutual
TLS
because
the
source
at
zetano
needs
to
present
the
app
Ace
certificate
and
the
destination
Z
tunnel
using
similar
way
it
can
impersonate
application
B.
A
So
it
also
serves
as
a
XDS,
client
and
also
CA
client.
So
it
gets
the
app
B
search
here
and
it
also
gets
the
right
configuration.
So
now
what
happens
when
the
package
arrives
at
the
destination
time?
No,
the
first
thing
it
does
is
to
terminate
the
mutuality
OS
that
that
traffic
is
terminated
and
then
it's
going
to
do
a
policy
check.
Remember
Justin
talk
about
you
can
do
layer
for
policies.
A
So
it's
going
to
check
if
application
a
is
allowed
to
call
application,
B
right
on
that
particular
port
number,
and
if
it's
allowed.
Yes,
let's
go
ahead
forward
the
package
to
application
B
and
that
will
be
plain
text
forwarding
and
if
it's
not
allowed
it's
going
to
drop
the
package.
So
it's
not
going
to
let
the
request
go
through.
A
Justin
also
talked
about
Waypoint
proxy.
One
of
the
key
innovation
in
istio
ambient
service
mesh
is
the
two
layer
approach
right.
The
layer
4
is
multi-tenancy
with
Z
tunnel
and
optionally.
You
can
add
layer
7
through
Waypoint
proxy
only
if
you
need
that
functionality.
So
in
the
case
there
is
a
waypoint
proxy.
For
instance,
you
need
a
layer,
7
processing,
so
the
source
data
node.
A
It
would
be
programmed
automatically
by
Israel
control
plan
through
the
XDS
client
and
configuration
from
istio
control
play,
and
then
it
would
notes
to
send
the
traffic
to
the
Waypoint
proxy.
So
the
Waypoint
proxy,
it's
going
to
represent
service
B
service
account
in
this
example
and
the
Waypoint
proxy
is
also
going
to
get
the
application
B
search
from
the
SEO
control
plane
and
the
the
interesting
thing
here
about
Waypoint
proxy
is,
it
doesn't
represent
more
than
one
search.
It
only
represents
the
application
research.
A
So
it's
going
to
go
through
the
SIM
card
to
istio
control
plane,
which
we
talk
about
and
then
from
there.
The
Waypoint
proxy
is
also
having
XDS
config
from
the
Israel
control
plane.
So
it
knows
to
forward
the
traffic
further
to
the
destination
the
tunnel
in
the
case
of
the
Waypoint
products,
all
right,
so
that's
how
it
works
in
the
basic
scenario
with
source
and
targets
Eternal
and
whether
you
have
a
waypoint
proxy
in
in
for
your
layer,
7
processing.
Now,
let's
talk
about
how
sidecar
Works
in
istio,
1.16
and
master.
A
So
the
purpose
to
reason
why
we
put
Edge
bone
support
for
sidecar
is
for
interoperability
right
when
you
guys
run
sidecar
with
1.16
and
then,
when
you
use
ambient,
you
can
actually
have
them
talk
to
each
other.
The
reason
is
the
z-tunnels
speak
hatchable
and
then
the
sidecar
post,
1160
or
newer
can
also
speak
about
h-bone
so
that
you
can
easily
interact
operator
which
is
really
really
cool.
The
next
thing
I
want
to
talk
about
is
what,
if
the
source
is
in
ambient
and
the
application
D
is
outside
of
mesh.
A
So
in
this
case
it's
still
control
plane
is
going
to
be
automatically
programmed
the
source
z-tunnel
to
recognize
the
application.
The
destination
is
outside
of
the
mesh,
and
it's
going
to
try
to
send
the
plain
text
traffic,
because
that's
the
only
traffic
the
application
D
could
understand,
and
the
other
scenario
is
what,
if
the
the
source
is
I
guess
is
outside
of
the
mesh
right.
The
application
e
here
and
the
destination
is
application.
B
is
part
of
ambient,
and
then
it
also
have
a
waypoint
proxy
in
this
case
right.
A
So
the
way
it
works
is
application.
E
will
send
the
traffic
to
application
B
and
because
of
the
traffic
redirect
setup
by
the
cni.
It
would
always
capture
the
traffic
on
the
destinations,
Eternal
and
then
the
destination.
The
tunnel
will
do
a
high
opening
and
forward
the
traffic
to
the
Waypoint
proxy
for
application
B.
If
application
B
has
a
waypoint
proxy,
so
this
would
come
through
the
HBO
Inc
encapsulation
and
it
was
it
would
be
using
the
application
based
search
on
both
Zee
tunnel
and
also
the
happy
Waypoint
proxy.
A
All
right,
I
think.
That's
all
the
scenario
we
have
for
different
packages,
I've
used
I,
guess
I
just
want
to
quickly
talk
about
the
state
of
istio
ambient
service
mesh
at
the
moment.
So
it's
an
experimental
branch
in
istio
we're
working,
really
really
hard
in
the
community
to
merge
to
master
John,
actually
started
a
list
of
things
that
we
need
to
finish
before.
Drive
and
bn2
to
master
and
people
can
start
to
write
in
production.
So
give
us
a
little
bit
more
time.
We
do
expect
to
be
merging.
Master
is
a
very
high
priority.
A
In
Upstream
we
actually
have
weekly
meetings
with
contribute
as
well.
Google
solo
and
AWS,
Cloud,
redhead
and
couple
of
other
companies
participate
in
the
meetings,
so
really
really
excited
about
that
we're
also
looking
at
optimized
z-tunnel,
we
had
some
challenges
with
configure
detail
now
to
be
multi-tenancy
with
it
wasn't
designed
to
be
multi-tenancy,
so
we're
looking
at
optimize
Z
tunnel,
we're
trying
to
standalize
the
API
between
the
control
plane
and
also
the
data
play,
and
you
know
be
able
to
upgrade.
A
Allow
you
guys
to
upgrade
from
sidecar
today
whether
you're
running
it
in
your
production
environment
to
SEO
ambient,
and
we
highly
recommend
you
all
to
get
involved
in
the
istio
slack.
They
are
I
believe
in
select.co.io,
if
not
part
of
the
member
register.
There's
an
ambient
Channel
part
of
the
istio
slack
and
the
weekly
contributor
meeting
with
that.
I
would
like
to
thank
you
all
and
I
would
love
to
hear
questions
from
the
audience
all
right.
Anyone
have
any
questions
all
right.
C
I
actually
have
two
questions:
if
that's
okay,
so
even
though
it's
a
layer
4
proxy,
do
you
think
it
becomes
a
bottleneck
for
everything
running
on
the
Node
and
how
do
you
scale
it
as
the
workloads
are
scaling
up,
and
my
second
question
is:
we
talked
about
reduced
operational
overhead,
but
it
seems
that
the
overall
net
complexity
of
the
system
would
you
say
it's
comparable
to
the
sidecar
approach
or
it's.
You
know
at
the
same
order
of
magnitude
just
delegated
more
to
the
node.
B
Sure
so,
first
of
all
on
the
the
Z
tunnel,
so
Lynn
had
mentioned
that
we're
looking
at
optimizing
the
Z
tunnel
So.
Currently
the
way
it's
implemented
is
we've
taken.
Envoy
and
we've
been
we've
modified
it.
We
have
to
create
a
lot
more
tunnels
than
I.
Think
Envoy
is
usually
set
up
for,
and
so
the
scale
isn't
great
for
that.
But
we
are
looking
at
a
rust
implementation.
That's
showing
looking
quite
promising,
so
even
with
like
20
000
tunnels
we're
seeing
it
use
less
memory
than
than
Envoy.
B
So
we
have
to
look
at
you
know
introducing
the
new
debugging
tools
to
make
it.
You
know
easier
to
trace,
for
example,
where
packets
are
getting
dropped.
You
know
if
something's
going
on
in
the
network,
that
sort
of
thing,
so
we
do
recognize
it's
something
that
we
need
to
to
work
on
to
to
make
it
Deployable.
A
Yeah
can
I
ask
you:
have
you
tried
the
istio
ambient
service
mesh?
Okay?
Well,
the
question
you
ask
are
really
good,
which
made
me
think
you
already
tried
it
I
mean
I
totally
agree
with
what
Justin
said.
I
would
say.
The
other
thing
you
want
to
also
look
at
is
the
complexity
with
sidecar
right,
because
if
you
have
a
unique
container,
if
you
have
kubernetes
jobs,
if
you
have
service
and
protocol,
you
know
the
transparency
to
the
hurdle
together.
A
Working
with
sidecar,
you
know
you're
actually
paying
a
lot
of
complexity
and
then
ambient
is
it's
a
baby
at
the
moment
right,
it's
experimental
so
give
us
time
to
walk
through
the
debuggability.
You
know
a
lot
of
performance
issue,
ambient
it's
actually
as
performant
as
psycha,
even
with
its
experimental
stage.
So
that's
very
impressive.
How
many
years
do
we
spend
to
work
on
cycle
five
plus
years
and
Ambience?
Just
you
know,
six
months
plus
so
yeah
great
question.
All
right!
That's
another
question.
D
Hi
there,
that
was
a
great
talk,
so
I
wanted
to
understand
a
little
bit
on
the
resiliency
of
the
Z
tunnels
right.
So
how
do
you
build
the
resiliency?
Because
what
if
the
Z
tunnel
has
a
failure
right
and
say
there
can
be
multiple
reasons
for
the
failure.
So
how
do
you
build
the
resiliency
in
such
cases,
because
I'm,
sure
more
and
more
usage
has
come?
The
failures
will
keep
coming
as
well
right.
So.
B
Yeah
I
mean
I.
Think
that
you
know.
One
of
the
hopes
is
that
the
Z
tunnel,
the
way
that
we're
implementing,
will
be
much
simpler
than
the
the
sidecar
proxies
so
you're
right
I
mean
there
is
going
to
be
that
single
point
of
failure.
I
mean
we
have
other
examples
of
that.
Also
within
you
know,
within
kubernetes,
within
networking
Stacks.
A
Yeah
I
would
add
the
way
to
think
about
the
Z
tunnel
is
think
about
it
as
your
cni
right.
What?
If
your
cni
is
not
running
on
the
node
right,
it's
real,
but
it
could
happen
right.
That's
also,
it's
really
important
when
you
design
your
application,
you
want
to
make
sure
it's
higher
availability
across
different
nodes,
so
yeah
just
think
about
it
as
a
cni
part
of
the
infrastructure,
yeah.
E
A
Yeah,
that's
a
really
good
question.
Yeah
we've
actually
heard
a
lot
of
people
asking
for
that
yeah,
the
the
way
we
implemented
it
right
now
at
the
moment,
how
you
deploy
a
waypoint
proxy.
We
haven't
talked
about
that,
so
it's
using
the
kubernetes
Gateway
API.
So
you
basically
tell
us
you
need
a
waypoint
proxy
for
your
application
and
then
we
would
automatically
provision
the
Waypoint
proxy
for
you.
A
F
B
Yeah,
so
the
way
that
it
So
currently
works
is
that
there
would
be
a
new
connection
for
each
workload,
Tuple
and
so
right
now,
I
think
it
just
all
they
all
share
a
single
h-bone
connection.
I.
Imagine
it
wouldn't
be
that
difficult
to
to
do
some
sort
of
of
load
balancing
for
like
Z
tunnel
to
Z
tunnel.
B
We
are
looking
at
the
ability
to
scale
the
Waypoint
proxies,
in
which
case
there
would
be
some
sort
of
L4
load
balancing.
So
you
know
if
one
of
those
namespaces
was
enabled
it
had
a
number
of
it
needed
a
number
of
Waypoint
proxies,
then
we
would
do
the
the
load
balancing
on
the
on
the
the
the
client
side.
G
A
Yeah,
that's
a
great
question:
it's
something
we're
actively
working
on
I,
believe
Leia,
7
Telemetry
is
in
place
with
the
experimental
Branch.
A
couple
of
us
actually
tried
it,
so
you
can
actually
go
to
the
premises,
the
endpoint
to
get
all
pretty
much
all
the
istio
metrics,
like
the
total
request,
count
the
HTTP
metrics,
that's
all
available
today
with
is
your
ambient
service
match
the
layer
for
Telemetry.
It's
been
actively
working
on
you'll,
see
on
my
team,
been
doing
a
lot
of
work
on
that
it
hasn't
made
to
the
branch.
A
Yet
we
also
have
red
hat
team
from
kayali
who
actually
tried
to
put
istio
ambient
the
services
in
ambient
in
the
kyali
graph
and
they've
been
raising
to
us
some
of
the
missing
metrics.
So
yeah,
that's
definitely
an
area
we
would
look
into
next
and
to
show
it
up
the
observability
graph
in
different
tools.
Yeah.
B
Yeah
I
I
will
add.
One
thing,
though,
was
which
is
that
in
order
to
get
the
performance
up,
we
try
to
drop
one
of
the
envoy
hops.
So
if,
for
example,
there
you
know
previously,
you
would
have
a
sidecar
on
both
sides
of
the
connection.
Now,
what
we
want
to
do
is
have
just
a
sidecar
or
not
a
sidecar,
but
we
just
want
an
Envoy
proxy
more
on
the
server
side
to
enforce
policies.
B
So
that
means
some
of
the
the
Telemetry
that
you
might
get
for
like
request
latency,
that
might
not
be
that's
not
going
to
be
available
just
because
that
is,
you
know,
we're
doing
a
different
model.
We
do
have
some
thoughts
about
how
we
might
be
able
to
to
impro
to
bring
some
of
that
back.
But
currently
that's
that
that
is
missing.
A
Okay,
I
have
to
apologize
if
we
actually
run
way
over
it's
10
56,
because
I'm
the
MC
for
the
next
session.
So
really
apologies
I,
just
didn't
keep
track
of
time
really
well
so
I
would
say.
Thank
you
all
for
joining
us
for
this
session.
I
hope
you
guys
enjoyed
it
and
learned
something
and
for
folks
you
ask
good
questions
come
by
and
get
your
books
here.
So
with
that
can
I
have
the
next
speaker
come
on
to
stage.