The most operationally dangerous thing you’ll read this week: Istio Ambient’s iptables changes can silently break kubelet readiness probes when you pair Ambient with a Cilium CNI-controlled cluster. It’s a tiny, low-level interaction — iptables source-NATs and packet path changes — but it up-ends the expectation that service mesh is orthogonal to node-level health checks.
That single incompatibility is the clearest symptom of a bigger truth: “sidecarless” and “kernel-native” aren’t synonyms, and mixing control planes without treating CNI + mesh as a single system will bite you. Platform teams need to stop thinking about mesh as a layer you can bolt on, and start treating it as part of the cluster’s networking contract.
Where the numbers actually point
Istio’s Ambient vs. Cilium comparisons report that Ambient mode can deliver roughly 20% more queries per core and better tail latency in high-QPS scenarios, while Cilium’s measurements often show lower CPU when datapath work (connection tracking, encryption, policy enforcement) is handled in-kernel via eBPF or kernel WireGuard. Those two statements look complementary until you realize they describe different trade-offs:
- Ambient reduces per-pod sidecar overhead by moving L7 interception and routing to a per-node ambient proxy (still Envoy-based) and leveraging node-level traffic redirection, which improves packing and tail jitter for bursty, high-QPS services.
- Cilium’s advantage comes from kernel offload: connection tracking, some policy evaluation, and encrypted tunnels (e.g., WireGuard) can be implemented without heavy userland context switches, which often shows up as lower CPU for the same throughput.
Pick one, or pay to operate both.
Why the readiness-probe problem matters
There have been reports and issues where Ambient-mode traffic capture and iptables rewrites change probe source IPs or packet paths in ways that interact poorly with CNIs that manage BPF-based datapaths. Readiness probes failing because of packet path rewrites lead controllers to restart pods, which cascades into retries, degraded SLOs, and noisy autoscaling events.
This is not a “fix your probe config” problem. It’s a contract mismatch: Ambient assumes it can control iptables/NAT behavior for L7 routing; a kernel-native CNI like Cilium assumes the datapath behaves according to its BPF programs. When those expectations collide you get nondeterministic behavior that only shows under load or during rolling updates.
Observability and GitOps are now part of the mesh
Observability isn’t an afterthought — it’s how you detect kernel-vs-node-vs-sidecar mismatches. Cilium’s Hubble and its eBPF program checks are practical ways to validate that policies, connection tracking, and encryption hooks are where you expect them. The community is already treating those checks as part of deployment automation: register the Cilium Helm repo as a Flux HelmRepository and install via HelmRelease; include Hubble health/status and eBPF-program validation in your pipeline.
If you haven’t already, codify eBPF-program and Hubble health as part of your Flux manifests and pre-rollout gates. Follow the Cilium datapath guidance for your release stream — those eBPF datapath settings and operational notes aren’t optional fine tuning; they shape the failure surface.
One blunt take
Ambient mode is clever and it’s the right idea for reducing sidecar overhead in many high-throughput services. But running Ambient on top of a kernel-native CNI without treating the duo as a single system is recklessly optimistic. Platform teams that try to stitch Ambient and Cilium together expecting them to be drop-in compatible are creating a new class of operational debt.
What to do next
Test mixed configurations with real readiness and liveness traffic patterns. Add liveness/readiness behavior to your chaos and scale tests. Bake Hubble/eBPF checks into your GitOps reconciliation so you fail fast on datapath mismatches. And decide: are you standardizing on a kernel-native mesh (Cilium) or an Ambient-style control plane (Istio Ambient)? Standardize; the cost of indecision is noisy failure modes.
Expect convergence: vendors and projects will keep narrowing the API-level mismatch between kernel hooks and L7 control planes, and tooling will evolve to validate datapath contracts automatically. Until then, treat CNI+mesh as a single system boundary — or accept the operational surprises that follow.