Ambient or sidecar is not a matter of faith
Four posts later and no further than before? So which is it, Ambient or sidecar? It depends. On what? The following grid with five rows helps.
- Date
- Topic
- Ambient
- Sources
- 7
- Reading time
- 3 min
- Version
- Translation
The knock-out question first: what does the setup dictate? VMs in the mesh, Primary-Remote across several clusters and EnvoyFilter currently run only with sidecars, Istio’s docs say so too (report #26). Ambient does handle multi-cluster by now, as Multi-Primary across separate networks, currently Beta and not really for critical production yet. If you get stuck here, you don’t need the grid yet.
Figure as text
Decision grid Ambient or sidecar as a table with five rows and two columns: L7 need (high, waypoint would be standard, favors sidecar; low, mostly mTLS and identity, favors Ambient), operational maturity (runbooks shaped by sidecars versus on top of ztunnel and waypoint), isolation (one proxy, one workload versus node layer accepted), fleet (manageable versus thousands of proxied pods) and migration window (none in sight versus stages and gates planned). Below, two boxes: the knock-out question first (VMs in the mesh, Primary-Remote and EnvoyFilter currently run only with sidecars, according to Istio's docs) and the rule for mixed mode (L7 policies at the waypoint don't apply to sidecar callers, the split follows the call relationships). Punchline: If you couldn't write your decision down, you haven't made one yet.
Then the five rows.
Share of workloads with a real need for L7, meaning routing, policies on methods and paths, HTTP telemetry (report #25). Low: Ambient’s operations promise comes into its own. High: the waypoint turns from special case into standard component, and the advantage shrinks.
Operational maturity of the team. Are there runbooks for ztunnel and waypoint, or does the knowledge live in one, two or three heads? That bus factor has a say before any benchmark does.
Isolation requirements. Does a proxy problem have to stay confined to one workload, for instance for compliance reasons? That favors sidecars (report #26).
Size and resource pressure of the fleet. Thousands of pods, each with its own proxy, are a real cost item that a shared node layer brings down. The measurement from report #22 tells you by how much.
Migration window. Stages need time and gates (report #27). Without a window, you’re implicitly choosing the status quo.
In practice, the result is rarely an either-or but mixed mode: Ambient for the bulk of the workloads, sidecars where L7 and isolation are hard requirements. Both modes run in the same mesh (report #27). One rule comes with it: L7 policies at the waypoint don’t apply to calls from sidecar sources. So the split follows the call relationships, and the namespace alone isn’t enough for that.
And then the decision gets documented like any architecture decision: with a date, the criteria as they stood, and the reasoning. The mesh is an organizational decision (report #10), and organizations forget faster than any cluster.
If you couldn’t write down your mesh decision today, with date and reasoning, you haven’t made one yet.
I fill in this grid together with teams in architecture assessments. The answers stay with you. What I bring is the experience from many setups. A DM is enough.
Next week a new series begins at stage zero: the Gateway API, and who owns a route.
