For the complete documentation index, see llms.txt. Markdown versions of all docs pages are available by appending .md to any docs URL.

Add Kubernetes namespaces or pods to your ambient mesh.

Adding workloads to the mesh requires only a label on a namespace or pod. No application restarts or sidecar injection are needed. Removing the label removes the workload from the mesh.

To add an entire namespace:

kubectl label namespace $NAMESPACE istio.io/dataplane-mode=ambient

To add a specific pod:

kubectl label pod $POD istio.io/dataplane-mode=ambient

Once labeled, all Layer 4 (L4) traffic to and from enrolled workloads is automatically intercepted and secured with mutual TLS (mTLS) by the ztunnel running on the same node. No further configuration is required.

Next steps