The mesh in the real world — the sidecars you inherit, migrating without an outage, tracing, egress, multicluster, cost, upgrades, and debugging it at 3am.
Istio 1.30 injects its proxy as a Kubernetes native sidecar — so the app cannot start before the proxy, and the Job that used to hang at 1/2 forever now finishes. Most of what you have been taught to hate about sidecars is history, and a book that repeats fixed bugs as current is worse than useless.
Three labels and a restart takes a namespace from sidecars to ambient, and my client saw 220 requests and 220 x 200 — which is one trial, on a cluster I control, and you should not plan a migration around it. Here is the migration, and the security control it silently takes away from you.
The standard channel of Gateway API v1.4 has no retry field, and the API server will tell you so rudely — which is why VirtualService is not nostalgia, it is load-bearing. Here is the split nobody explains: what happens to a request on the way, and how you talk to the destination once it is chosen.
Fault injection, delay injection, and header-based routing — how to break a dependency on purpose without touching it, and why a weighted split can never send *your* traffic to the canary.
Access logs, custom metrics, and trace sampling — turned on for one namespace, with no code change, by an object whose real job is deciding what you are *not* going to pay to collect.
The mesh injects the trace headers, and your app throws them away — so I fixed the app, and the trace still did not connect. The one thing in these three books that did not come for free, reported honestly.
The egress lockdown every Istio tutorial teaches blocks a sidecar pod and does not block an ambient pod — same cluster, same setting, no error, no warning. Migrating to ambient can silently open your egress to the entire internet.
RequestAuthentication validates a JWT if one is present — and does not require one. No token returns 200. The gate is a second object, and shipping only the first is the classic JWT mistake.
ext_authz is the escape hatch: the mesh calls out to a service you wrote and enforces whatever it says. This chapter is described, not run — and the fail-open switch is the most consequential line of config in it.
A second cluster fits on the laptop. A shared root CA works, and it is the thing multicluster is actually made of. The east-west gateway is where the lab ran out of node — and that failure is the most honest thing in this chapter.
Measured, not estimated: what a sidecar costs, what ambient costs, and the arithmetic that quietly decides which data plane you should be running — plus an honest account of the numbers I did not take.
Istio supports two minor releases at a time, so the version you pin today goes end-of-life before your next planning cycle finishes — and the only sane way through is a second control plane, a tag, and one namespace at a time.
A mesh adds a debugging surface that did not exist before, and its failures are the ones that look like something else — so learn the shape of each denial, and never trust a measurement taken on a dirty cluster.
One incident, assembled only from things this track actually ran — a Ready pod serving nothing, a policy enforcing nothing, a measurement that lied for twenty minutes, and an egress lockdown that quietly stopped locking. And then the end of three books.