Ambient Mode Complete Traffic Flow

Ambient Mode Complete Traffic Flow A sequence diagram generated by Archify. 1. TCP request 2. mTLS connection mTLS encrypt · L4 metrics 3. Plain TCP mTLS decrypt · L4 metrics 4. Response 5. mTLS response 6. Plain response 1. HTTP request 2. HBONE tunnel L7 routing · header matching · circuit breaker · retry 3. mTLS to target 4. Plain HTTP 5. Response 6. mTLS response 7. HBONE tunnel 8. Response L4 Only Path (Basic Scenario) L7 Path (Advanced Routing) Client App · No Sidecar · Sequence participant Client App No Sidecar Client ztunnel · client node · L4 proxy · Sequence participant Client ztunnel client node · L4 proxy Waypoint Proxy · L7 · optional · Sequence participant Waypoint Proxy L7 · optional Server ztunnel · server node · L4 proxy · Sequence participant Server ztunnel server node · L4 proxy Server App · No Sidecar · Sequence participant Server App No Sidecar Legend request return security default message

L4 Only Path (ztunnel only)

  • • Minimal latency (~1ms)
  • • mTLS automatically applied · basic telemetry
  • • Sufficient for 80-90% of workloads

L7 Path (ztunnel + Waypoint)

  • • Header-based routing
  • • Circuit Breaking · Retry/Timeout
  • • When complex traffic policies are needed