Skip to main content

Node-level datapaths — A · B · C

CONDITION 2 · Pod-A namespace mesh enrollment? — no mesh installed → A · label ENABLED → B · label ABSENT → C

Single backendRef → Service (Pod-A): each column follows the packet from Pod-A's namespace out through the node's kernel (and, in B, user space) to the physical NIC. The shared ingress trunk precedes all three.

Standard K8s routingkube-proxy / Calicoistio-cni interceptionztunnel proxyHBONE / mTLSGateway API ingressHTTPRouteMetalLB LoadBalancerVIPPolicy miss / bypassed
A · Standard Kubernetes
POD-A NAMESPACELINUX KERNEL SPACE · NODE-11 · Plaintext TCPPod-AApp code2 · Enter kernelveth-AVirtual NIC3 · Svc IP → Pod IP (DNAT)kube-proxyDatapath V24 · Encapsulate & transmitCalicoRouting engine (CNI)Physical NIC-1Onto the wire
B · Ambient — Redirection
POD-A NAMESPACE · LABEL ENABLEDLINUX KERNEL SPACE · NODE-1USER SPACE · NODE-1KERNEL SPACE · CONT.1 · Plaintext TCPPod-AApp code2 · Enter kernelveth-AVirtual NIC3 · Policy MATCH → redirect to user spaceistio-cnieBPF / iptables interception check4 · L4-encrypted HBONE/mTLS → re-enter kernelztunnelTransparent proxywraps in HBONE / mTLS5 · Svc IP → Pod IP (DNAT)kube-proxyDatapath V26 · Encapsulate & transmitCalicoRouting engine (CNI)Physical NIC-1Encrypted traffic on the wire
C · Ambient — Bypass
POD-A NAMESPACE · NO LABELLINUX KERNEL SPACE · NODE-11 · Plaintext TCPPod-AApp code2 · Enter kernelveth-AVirtual NIC3 · Policy MISS →bypass ztunnelistio-cniInterception check✕ztunnelIdle · 0% traffic4 · Svc IP → Pod IP (DNAT)kube-proxyDatapath V25 · Encapsulate & transmitCalicoRouting engine (CNI)Physical NIC-1Plaintext traffic on the wire

A · Standard Kubernetes​

No mesh components installed — IF · no mesh installed

  • 1 — App in Pod-A opens a plaintext TCP connection.
  • 2 — Packet exits via veth-A into the host kernel.
  • 3 — kube-proxy DNATs the Service IP to a target Pod IP.
  • 4 — Calico resolves the route, encapsulates (VXLAN/Geneve) if cross-node, and hands off to NIC-1.

B · Ambient — Redirection​

istio.io/dataplane-mode=ambient · label ENABLED — IF · istio-cni policy MATCH (label enabled)

  • 1–2 — Plaintext TCP leaves Pod-A via veth-A into the kernel.
  • 3 — istio-cni rules match the ambient-labeled namespace and redirect the flow.
  • 4 — ztunnel hijacks the connection and wraps it in HBONE (mTLS).
  • 5–6 — Encrypted packet takes the standard kube-proxy → Calico → NIC path.

C · Ambient — Bypass​

Mesh installed · namespace label ABSENT — IF · istio-cni policy MISS (no label)

  • 1–2 — Plaintext TCP leaves Pod-A via veth-A into the kernel.
  • 3 — istio-cni check misses (namespace not enrolled); ztunnel stays idle and is never touched.
  • 4–5 — Packet continues on the standard kube-proxy → Calico → NIC path, unencrypted.