The Complexity of Modern Kubernetes Networking
Kubernetes has transformed how teams build and scale applications, but it has also introduced new layers of complexity. Platform and DevOps teams must now integrate and manage multiple technologies: CNI, ingress and egress gateways, service mesh, and more across increasingly large and dynamic environments. As more applications are deployed into Kubernetes clusters, the operational burden on these teams continues to grow, especially when maintaining performance, reliability, security, and observability across diverse workloads.
To address this complexity and tool sprawl, Tigera is incorporating Istio’s Ambient Service Mesh directly into the Calico Unified Network Security Platform. Service mesh has become the preferred solution for application-level networking, particularly in environments with a large number of services or highly regulated workloads. Among available service meshes, Istio stands out as the most popular and widely adopted, supported by a thriving open-source community. By leveraging the lightweight, sidecarless design of Istio Ambient Mode, Calico delivers all the benefits of service mesh, secure service-to-service communication, mTLS authentication, fine-grained authorization, traffic management, and observability, without the burden of sidecars.
Complementing this addition is Calico AI. Calico AI brings intelligence and automation to Kubernetes networking. It addresses the massive operational burden on teams by allowing them to interrogate complex network data and configurations using simple, natural language.It empowers teams to troubleshoot faster, detect anomalies, and optimize configurations using natural language prompts. Together, Calico AI and Istio Ambient Mode will help Kubernetes teams streamline operations, unify their toolchains, and manage complex Kubernetes environments with greater efficiency and confidence.
Introducing Istio Ambient Mode in Calico
Service mesh is critical for managing service level traffic, security, and observability. However, deploying and managing a separate service mesh results in an operational burden on platform teams. Tigera tackles this operational challenge head-on by including Istio Ambient Mode, bringing a new level of efficiency to service mesh deployments.
Istio Ambient Mode’s sidecarless design provides built-in encryption, authentication, authorization, fine-grained L7 traffic control right within the Calico platform. As a result, platform teams can easily enable essential capabilities like mTLS, workload identity enforcement, and advanced L7 traffic controls (such as routing rules, retries, failovers, and fault injection) without the considerable operational overhead associated with thousands of individual sidecars.
Deep Dive: What is Istio Ambient Mode for Calico?
Calico is adding an enterprise-hardened 100% upstream distribution of Istio Ambient Mode into Calico. Istio Ambient Mode is a lightweight, sidecarless service mesh that provides built-in encryption, authentication, authorization, and L7 traffic control, which can now be managed through the Tigera Operator. Unlike service meshes that deploy a sidecar proxy with every pod, Istio Ambient Mode introduces a shared data plane that uses Istio’s ztunnel and waypoint proxies. This design dramatically reduces compute overhead, speeds up deployment, and simplifies operations.
By incorporating Istio Ambient Mode directly into Calico’s operator-managed architecture, Tigera eliminates the need for manual service mesh configuration and ensures seamless compatibility with leading Kubernetes platforms (GKE, EKS, AKS, Rancher, Openshift, and more).
✨The result: a secure, scalable, and intelligent service mesh that works out of the box.
Key Features and Benefits
1. Simplified, Sidecarless Architecture
Traditional service meshes require using thousands of sidecars, one per pod, increasing resource consumption, latency, and maintenance complexity. Calico Istio Ambient Mode replaces that model with a zero-sidecar architecture, allowing workloads to join the mesh with a simple namespace label:
kubectl label namespace default istio.io/istio-data plane=ambient
This streamlined side-carless approach reduces compute and memory overhead, accelerates rollouts and upgrades, and simplifies troubleshooting. Platform teams no longer need to manage sidecar injection failures or version drift, enabling faster innovation and more predictable performance.
2. Fully Compatible with Calico and Kubernetes Network Policies
In Istio Ambient Mode, when an application sends network traffic, that traffic first gets routed through a secure tunnel that uses port 15008. After going through the tunnel, the traffic continues on to wherever it was originally meant to go. The problem is that Calico or Kubernetes network security rules can only allow or block traffic based on that tunnel port (15008), not the application’s real destination.
With Calico Istio Ambient Mode, the ztunnel component is enhanced so that your existing Calico or Kubernetes security rules still work as expected. This means you don’t have to add special exceptions or open port 15008, your current network policies continue to apply normally.
3. Built-In L7 encryption with mTLS Everywhere
With Istio Ambient Mode, mutual TLS (mTLS) becomes a default capability, providing encryption in transit for all service-to-service communication. And it also ensures that workloads automatically inherit secure identities and policy controls through Istio’s ztunnel layer.
Security engineers will be able to enforce fine-grained access control at both L4 and L7 using Istio’s native AuthorizationPolicy resources that will be fully compatible with Calico’s GlobalNetworkPolicy model. Note: this capability should be available early next year, and will bring network-layer security and application-layer security under one platform, aligning with zero-trust best practices and compliance requirements.
4. L7 Observability and Visibility
Istio Ambient Mode brings deep application-layer observability to the Calico platform. Information from OpenTelemetry that is used by Istio Ambient Mode can automatically be used with Calico, providing a single-pane-of-glass view for troubleshooting latency, network errors, or L7 policy violations. Operators can easily identify which traffic flows are encrypted, which services are underperforming, and where bottlenecks exist.
✅ This enhanced L7 visibility coupled with Calico’s L3/L4 visibility helps teams maintain reliability and performance in dynamic Kubernetes environments, and quickly troubleshoot issues.
5. Operator-Managed Simplicity and Automation
Deploying and managing a service mesh can be daunting, but not with Calico. The Tigera Operator fully automates the provisioning, configuration, and lifecycle management of Istio Ambient Mode.
The Tigera Operator installs all dependencies, configures network policies, and ensures cloud compatibility. It even handles automatic cleanup when the Istio Ambient Mode resource is deleted, removing complexity from Day 2 operations.
✅ This automation not only saves time but ensures consistent, secure, and repeatable deployments, aligning perfectly with modern GitOps practices.
6. Future-Ready L7 Policy and Tiering
As part of Tigera’s “Unified Platform” vision, Istio Ambient Mode lays the foundation for next-generation L7 policy management. While the initial release of Istio Ambient Mode will leverage Istio’s native L7 network policies, upcoming releases will integrate these directly with Calico’s tiered network policy model.
✅ This future alignment means customers will gain unified control across all layers of security, from network access to application-layer authorization, all managed within a single unified platform.
Calico AI: Achieving Operational Simplicity
While Kubernetes delivers immense power and scalability, it often comes with a trade-off: large amounts of operational complexity. Platform and DevOps teams often waste significant time manually sifting through logs and dashboards, simply trying to find the root cause of a single issue.
Calico AI introduces a powerful, AI-driven assistant designed specifically to simplify these manual Kubernetes operations. Instead of manually tracing traffic or parsing logs, Calico AI uses natural language to transform complex data into actionable insights.
Teams can now simply ask questions like:
- Which services are receiving external traffic?
- What policies have denied traffic in the last 48 hours?
- Which anomalies and misconfigurations are most likely to cause an outage?
The Calico AI assistant does more than just answer questions; it can proactively detect anomalies and recommend policy improvements. By turning network data into actionable insights, Calico AI helps teams move from reactive troubleshooting to proactive optimization and security, dramatically reducing their daily operational burden.
Deep Dive: What Is the Calico AI Assistant?
Calico AI Assistant is an intelligent, conversational assistant built directly into the Calico Unified Network Security Platform. It transforms the way platform, DevOps, and security teams interact with their Kubernetes environments by turning complex data into actionable insights.
Calico AI Assistant leverages the rich telemetry already captured by Calico, including flow logs, metrics, and policy data, to deliver context-aware explanations, summaries, and recommendations. Instead of navigating dashboards and crafting complex filters, users can simply ask questions like:
- “Why is traffic between these two services denied?”
- “Which workloads are currently exposed externally?”
- “Show denied flows from payments to auth.”
- “Recommend a policy to block egress from this namespace.”
By making Calico’s data accessible through a natural-language interface, Calico AI Assistant helps eliminate the friction of manual analysis, accelerates troubleshooting, and brings powerful automation to Kubernetes networking and security.
How It Works
Calico AI Assistant sits on top of Calico’s existing data plane and observability layer, using a retrieval-augmented generation (RAG) pipeline to interpret real-time telemetry and configuration data. The assistant processes user prompts through a secure backend API, classifies intent, retrieves relevant policy or flow information, and then generates an answer enriched with context from the Kubernetes cluster environment.
Key Features and Capabilities
1. Natural-Language Querying
Calico AI Assistant introduces an intuitive, chat-style interface that replaces complex filters and dashboards. Users can explore traffic flows, policies, and workloads using simple questions. This makes advanced capabilities, like flow log analysis or policy validation, easily usable by every engineer, regardless of Kubernetes expertise.
2. Proactive Insights
Beyond responding to queries, Calico AI Assistant proactively surfaces issues such as:
- Misconfigurations and unused policies
- Workloads with open or unsecured egress paths
- Anomalous or high-volume traffic patterns
- Network flows without corresponding network policies
These insights help teams prevent issues before they cause downtime or exposure.
3. Policy Recommendation and Validation
Calico AI Assistant can suggest policy improvements or new network policies based on observed behavior and security best practices. It also identifies policies that have not been triggered recently, helping maintain policy hygiene and reduce clutter.
4. Real-Time Troubleshooting
By connecting to Calico’s real-time telemetry, users can immediately identify why specific connections are denied, which policies are blocking traffic, or where latency or errors originate, all through conversational queries. This can dramatically reduce mean time to resolution (MTTR).
5. Secure and Compliant by Design
Calico AI Assistant is designed with strong data privacy and governance controls:
- RBAC-aware visibility ensures users only see what they are permitted to.
- Intent moderation filters unsafe or irrelevant queries.
- Prompt logging and redaction enable post-hoc auditing without exposing sensitive data.
Benefits of Calico AI Assistant
- Accelerated Troubleshooting: Resolve networking and policy issues in seconds instead of hours.
- Operational Efficiency: Reduce manual navigation and the use of manual queries and filters across multiple tools and dashboards.
- Proactive Security Posture: Automatically detect exposure risks, missing policies, and anomalies.
- Improved Policy Hygiene: Identify redundant or stale rules and receive guidance on optimization.
- Accessible Expertise: Empower every team member to work efficiently regardless of Kubernetes networking expertise through natural language.
- Governed Intelligence: Maintain compliance, auditability, and safe data access throughout all AI interactions.
Availability
Calico AI Assistant will be available in early 2026. The initial release of Istio Ambient Mode for Calico is scheduled for December 2025.
Intelligent and Unified Security for Kubernetes
Together, Calico AI and Istio Ambient Mode mark a major step forward in simplifying and securing Kubernetes networking and network security.
- With Calico AI Assistant, teams gain real-time visibility and actionable insights across their clusters. The AI assistant helps operators understand traffic patterns, detect anomalies, and identify misconfigurations before they cause outages. It transforms complex network data into clear guidance, helping platform and security teams move from reactive troubleshooting to proactive optimization.
- Istio Ambient Mode delivers lightweight, scalable service mesh capabilities directly within the Calico platform, without sidecars or added complexity. It provides built-in mTLS, workload identity, and fine-grained L7 traffic controls, making it easier to enforce zero-trust principles and manage secure communication between services.
Together, these two capabilities help improve a unified platform that seamlessly combines service mesh (ambient mode), CNI, network policies, ingress, and egress capabilities.
The Calico Advantage
Calico’s launch of Istio Ambient Mode and Calico AI Assistant delivers a unified platform that combines superior security, operational efficiency, and deep intelligence. This single, enterprise-hardened solution simplifies your Kubernetes environment while maximizing performance and control.
The result is greater operational efficiency, reduced tool sprawl, stronger security through consistent policy enforcement, and improved visibility across the entire Kubernetes environment, helping teams operate more efficiently and confidently at scale.
The benefits are tailored to the specific needs of your engineering teams:
- For Platform Teams: Less infrastructure to manage and faster, safer deployments.
- For Security Engineers: Consistent policy enforcement and built-in encryption across all workloads.
- For DevOps Teams: Clearer insights, fewer blind spots, and more resilient applications.
Next Steps: See Calico in Action 👇
Book a Demo: Request a personalized demo to experience the latest innovations in resilient networking, traffic visibility, and simplified operations.
Learn More: Read the detailed documentation on the Calico Unified Network Security Platform.
