Part 3 · 1 chapters · ~8 min

Ambient and Sidecarless Meshes

The sidecar tax, Istio ambient mode with per-node ztunnels and optional waypoint proxies, Cilium's eBPF datapath and service mesh, Kubernetes native sidecar containers, and the security and blast-radius trade-offs of shared node-level components.

7

Moving the proxy out of the pod

Kubernetes 1.28+ also added native sidecar containers (init containers with restartPolicy: Always) that start before and stop after the main container, fixing startup and Job-termination problems for classic sidecars.

AMBIENT AND eBPF MESHES
moving the proxy out of every pod
pod Ano sidecarpod Bno sidecarztunnel (per node)L4: mTLS, identitywaypoint proxyL7: routing, retries, authzCilium eBPFkernel datapath
swipe the figure sideways, or tap expand for full screen
1/5
the sidecar tax
Sidecars cost memory in every pod, add two hops per call, must be restarted to upgrade, and complicate jobs and startup ordering.
memory per pod, hops, upgrade restartsthe motivation for sidecarless