Istio's numbers are blunt: in their Ambient Mesh vs Cilium comparison, Ambient delivered 56% more queries at 20% lower tail latency than Cilium under the tested workload — 2,178 queries per core versus Cilium's 1,815. That's not a rounding error; it's a design trade-off showing up as real throughput and p99 behavior in L7 traffic.
That result landed around the same time Cilium published a maintenance patch for the 1.19 series, a release that continues hardening eBPF dataplane correctness, CLI fixes, and control-plane integrations for that line. The two items together matter because they force a practical question: if you're evaluating sidecarless meshes, which axis matters more — raw L7 performance and tail-latency at scale, or reduced cost and simpler L3/L4 profiles in smaller clusters?
Why Istio Ambient won (in these tests)
Istio Ambient is engineered to move most of the mesh responsibilities out of per-pod sidecars while preserving Istio's traffic management and policy model. In the benchmark scope Istio chose, that design paid off: higher queries-per-core and lower tail latency. The numbers suggest Ambient's runtime optimizations and control-plane interactions put less CPU pressure on dataplanes for the tested L7 patterns.
Put differently: if your traffic is L7-heavy, encrypted, and you rely on advanced Istio features (complex routing, telemetry, mTLS lifecycle, policy), Ambient's runtime and resource profile will likely beat a sidecarless approach focused on kernel offload for raw L3/L4 work.
Where Cilium still makes perfect sense
Cilium 1.19.x — and the maintenance patch specifically — continues to invest in an eBPF-forward dataplane that moves L3/L4 work into kernel context where it matters, and relies on user-space proxies (Envoy) for full L7 semantics. That model is cost-effective for smaller clusters and for workloads that are primarily L3/L4 or that can avoid pod-to-pod encryption. Cilium's sidecarless capabilities shine when you need low operational overhead, fewer containers per node, and minimal per-pod CPU on simple networking workloads.
The benchmark and Cilium's roadmap both underscore that sidecarless ≠ feature parity. Cilium optimizes for different trade-offs: lower per-pod footprint and cheaper throughput on unencrypted flows, while Istio Ambient optimizes for full L7 semantics and the operational expectations of large Istio deployments.
The operational tax of running both
There's a strong community temptation to "have your cake and eat it too": run Cilium as the CNI/eBPF dataplane and Ambient Mesh for Istio features. Don't. The two overlap deeply: eBPF-based packet handling, policy enforcement, and L7 interception interact in ways that are not orthogonal. Running both stacks in production increases the surface area for interactions, debugging, and failure modes — and it converts what should be a single operational model into two combined models.
If your org doesn't have a dedicated networking+service-mesh team with time to maintain that combinatorial complexity, you'll pay for it in outages, escalations, and baffling policy conflicts. Pick one primary stack and extend it only when the gain outweighs the added operational burden.
My take
This is the right time to stop arguing in absolutes about sidecars. The choice is pragmatic: choose Istio Ambient for large L7, encrypted, policy-rich deployments; choose Cilium for cost-sensitive L3/L4-heavy workloads and smaller clusters. Trying to force both into production because you want both benefits is a fast track to operational debt.
If you want a tighter read on Cilium 1.19 and the surrounding context, see our short note on the maintenance patch and what the Istio Ambient vs Cilium numbers actually mean for platform teams Cilium 1.19 maintenance patch and what Istio Ambient vs Cilium benchmarks really mean.
Expect more benchmark theatre in the months ahead. The real competitive battleground isn't a single qps/core number — it's the developer and operator experience of policy, telemetry, and upgrade stability when traffic patterns get messy. Platform teams that pick a single, well-understood dataplane will sleep better at 3am.
Sources
- cilium/cilium GitHub repository – Releases (1.19.5 latest)
- Cilium Service Mesh – eBPF-based sidecarless mesh overview
- Cilium Service Mesh – Everything You Need to Know (Isovalent blog)
- Scaling in the Clouds: Istio Ambient vs. Cilium (Istio blog)
- Cilium + Istio Ambient Mesh: what's the point of having them both? (r/kubernetes)