Two Components Share the Work of a Sidecar
A policy that looked harmless in review cuts connections in Ambient that it was meant to allow. The reason lies one layer down.
- Date
- Topic
- Ambient
- Sources
- 4
- Reading time
- 2 min
- Version
- Translation
A sidecar does everything in one container: mTLS, routing, policies, telemetry. Ambient splits this package into two parts, in two places.
Figure as text
Data path in Ambient across two nodes: pods contain only the app, no proxy in the pod; on every node, ztunnel (a separate Rust proxy, not Envoy) runs for L4, meaning mTLS, identity and TCP forwarding, always. Next to it, the waypoint, an Envoy that only enters the path where L7 is needed: HTTP routing, L7 policy, L7 telemetry. Below, two boxes: the mental boundary runs between L4 and L7, the pod boundary is the wrong compass in Ambient; in the waypoint, the four questions from report #12 apply (listener, route, cluster, endpoint). Punchline: an L7 policy without a waypoint blocks, when in doubt, even the clients it was meant to let through.
Part one is called ztunnel and runs once per node. It takes over the L4 layer: mTLS between workloads, identity, TCP forwarding. And it is not an Envoy. ztunnel is a separate proxy, written in Rust and deliberately kept lean, because on every node it serves all the pods. The matrix from report #11 already listed it as an engine of its own.
Part two is the waypoint. That one is an Envoy, and it only enters the path where a workload really needs L7: HTTP routing, AuthorizationPolicies on methods and paths, L7 telemetry. No need for L7, no waypoint, no Envoy in the path.
And this is where the trap from the first paragraph lies. Without a waypoint, an AuthorizationPolicy with L7 rules, meaning methods or paths, ends up at ztunnel, and ztunnel cannot evaluate L7. Istio turns it into a DENY policy: the connection breaks off, even for clients with the right identity. In review, the rule looked harmless because the reviewer was thinking in terms of pod boundaries. In Ambient, the mental boundary runs between L4 and L7. The pod boundary, which sidecar teams have reasoned along for years, is the wrong compass for this.
If you have read report #12, you already know the waypoint: listener, route, cluster, endpoint, the same engine, the same debugging. Here too, Envoy knowledge simply moves with you.
For the bill, that means: you only pay for L7 where you need L7. In return, someone has to be able to answer clearly which workloads those are and which policies carry L7 rules. This inventory is the real Ambient homework, architecture work instead of relabeling.
An L7 policy without a waypoint blocks, when in doubt, even the clients it was meant to let through.
Next week brings the assessment this arc has been heading toward: why I still stay with sidecars for hard enterprise requirements.
