Sidecar Mode vs Ambient Mode: Core Concepts

Sidecar Mode vs Ambient Mode: Core Concepts An architecture diagram generated by Archify. Application Container · application code · Sidecar Mode (Traditional) Application Container application code Envoy Sidecar · one per pod · Sidecar Mode (Traditional) Envoy Sidecar one per pod Application Container Only · no sidecar · Ambient Mode (New) Application Container Only no sidecar Node-level ztunnel · L4 Proxy · Ambient Mode (New) Node-level ztunnel L4 Proxy Waypoint Proxy · L7 Features · Ambient Mode (New) Waypoint Proxy L7 Features bidirectional Transparent When L7 needed Sidecar Mode (Traditional) Ambient Mode (New) Legend Backend Security

Sidecar Mode (Traditional)

  • • Each pod needs its own Envoy proxy (50-100MB memory)
  • • Sidecar initialization increases pod startup time
  • • Sidecar injection requires a pod restart

Ambient Mode (New)

  • • One ztunnel per node handles L4 (mTLS, basic telemetry)
  • • Waypoint is used only when L7 features are needed
  • • Adopted with no pod restart and no application changes