Istio’s Ambient mode just landed in the kind of benchmark write-up that forces platform teams to stop pretending service mesh is a single engineering choice.
The Istio engineering blog compared Ambient (a shared waypoint proxy outside application pods, with WASM extension points via Envoy) against Cilium’s eBPF-native service mesh and reported roughly 56% more encrypted L7 queries served and ~20% lower tail latency for encrypted L7 traffic in their test harness. Those are headline numbers for L7 workloads. The authors also note Cilium’s lower CPU use for L3/L4 workloads — the domain where eBPF delivers the most benefit.
This is not a “who wins” post. It’s a reminder the market has bifurcated into two compelling dataplane families: (a) proxy-based approaches that move the proxy out of application pods (Istio Ambient’s waypoint model + WASM) and (b) eBPF-first, in-kernel meshes (Cilium) that aim to subsume the mesh and CNI. Both are sidecarless in practical deployment, but they trade CPU, observability, and L7 capability differently.
Why the numbers don’t settle the debate
Istio’s Ambient numbers matter because they measure encrypted L7 throughput and tail latency — where a shared proxy plus WASM extensions can amortize TLS and L7 processing across connections. WASM lets teams add L7 features without inserting a per-pod Envoy binary.
Cilium’s advantage is different and no less real: moving the datapath into eBPF yields L2/L3/L4 efficiency, kernel-enforced network policy, and near-zero per-pod overhead. Cilium also provides Hubble for observability and supports integrations that let teams attach Envoy and configure L7 behavior when they need advanced routing or filters.
Practical trade-offs platform teams must accept
-
If your dominant load is encrypted L7 (many short-lived HTTP requests, tight tail-latency SLAs), the Ambient model’s shared proxy + WASM looks compelling. Mesh choice affects TLS termination, CPU sizing, and admission models.
-
If you want minimal CPU and deterministic L3/L4 forwarding, plus kernel-enforced network policy and wire-level observability, Cilium still wins. Expect lower cost and simpler scaling for L4-heavy workloads.
-
The hybrid option — pairing Cilium as the CNI with an Envoy-based Ambient path for L7 — is attractive but operationally pricier. You’re managing two dataplane models and two sets of failure modes; that’s workable for large orgs but an ops tax smaller teams will notice.
Opinion: stop arguing about “sidecar or no sidecar” and pick the plane you care about
This is overdue: service mesh isn’t a single hat any more. The community has converged on sidecarless workflows, but “sidecarless” now implies different runtime semantics. Platform architects who insist on one-size-fits-all meshes are making a managerial mistake. Decide whether your priority is L7 fidelity at scale (shared proxy + WASM) or kernel-level efficiency and policy (eBPF). Let that decision drive control-plane and CI/CD choices.
A short roadmap for what’s next
Expect tighter integrations and more official guidance on mixing Cilium and Ambient patterns. Control planes will add adapters so teams can run a single control plane over heterogeneous dataplanes, and WASM will increasingly be the common extension mechanism for L7 features across both families. In the meantime, recent Cilium patch releases continue to harden the eBPF datapath and Envoy integration.
If you run a platform, do one thing: pick the dataplane family you actually need and own the consequences — CPU sizing, observability pipelines, and failure modes — instead of keeping both as “maybe later.” Over the next year, teams that pick and optimize will see cost and latency wins; teams that hedge will pay that overhead in both engineering complexity and bills.
Further reading: Istio’s benchmark write-up is worth your time, and recent Cilium patch releases are already in play — see the platform analysis in our Istio benchmark piece and the Cilium patch summary for operational details: Istio Ambient Mesh Benchmark: 56% Higher Encrypted L7 Throughput vs Cilium and Cilium patch releases: eBPF dataplane stability and security.
Prediction: within 12 months the loudest engineering debates will be about operational boundaries (who owns certs, who owns throttling, who wires Hubble into tracing) — not whether eBPF is interesting. That argument is over.
Sources
- Scaling in the Clouds: Istio Ambient vs. Cilium
- Extending Sidecarless Applications with Wasm in Istio Ambient Mesh
- cilium/cilium GitHub repository (Releases section, v1.19.5)
- Cilium Service Mesh overview
- Service Mesh Observability Odyssey feat. Cilium, Istio, Linkerd, Kuma
- OneUptime: How to Deploy Cilium Service Mesh with Flux CD
- InfoQ: eBPF and Wasm – Exploring the Future of the Service Mesh Data Plane
- Reddit: Cilium + Istio Ambient Mesh — what's the point of having them both?