Istio Ambient Mesh and the Post-Nginx-Ingress Era: Kubernetes Traffic Reimagined

Every Kubernetes platform eventually hits the same wall: as services multiply, so do the problems of securing, observing, and controlling traffic between them.

A service mesh solves this - giving you mutual TLS, traffic policy, and golden-signal telemetry without changing a line of application code. For years that power came with a tax: a sidecar proxy injected into every pod, adding latency, resource overhead, and painful upgrade cycles. Istio's ambient mode rethinks that trade-off. A mesh without sidecars that you can adopt incrementally, with lower overhead and no pod restarts to onboard a workload.

In this session we'll cover the essentials: why you need a service mesh in the first place, what ambient mode actually is under the hood, how it differs from the classic sidecar model (and where each still makes sense), and the tips and tricks we've learned for rolling it out smoothly - with zero downt

Half of all cloud-native environments run the Nginx ingress controller, and as of March 2026 it is retired, with no more releases, bug fixes, or CVE patches. This session covers why nothing is a simple drop-in replacement and how to respond. We will give you a framework for choosing a controller swap and might also initialize migration to Gateway API. We will walk through the main alternatives: Traefik, Envoy Gateway, Istio, Cilium Gateway, and cloud-native controllers. We will also cover the migration itself, and the demo, includes a live test migration so you can see the process in action. Along the way, a clear look at where the real migration cost lives.