Istio

Istio extends Kubernetes into a programmable, application-aware network, bringing traffic management, telemetry and security to workloads running both in Kubernetes and outside it. It deploys proxy infrastructure only for the features selected, offers a zero-trust tunnel for Layer 4 performance alongside a fuller Layer 7 path, and states that its ambient mode, which runs without sidecars, is now generally available.

Ambient mode is the significant recent change and it answers the standard objection to service mesh. Running a proxy container beside every workload doubles the number of containers and adds memory to every pod, which is a cost operators noticed immediately. Removing the sidecar for workloads that only need Layer 4 security keeps the security guarantee and drops most of the overhead.

Mutual TLS between services is the capability most organisations actually buy it for. Encrypting and authorising service-to-service traffic without changing application code is a compliance argument as much as a technical one, and it is far cheaper than asking every team to implement it themselves.

Installation is worth deciding deliberately. Istio can be self-managed, installed through a cloud provider's one-click option, or bought as a fully managed mesh from a provider, and the operational burden differs enormously between those three.