istio:ambient-waypoint

You configure L7 AuthorizationPolicy in Istio Ambient mode by deploying waypoint proxies and labeling services to route traffic through them. This enables layer seven traffic inspection for granular access control without sidecars.

You need a waypoint proxy in Istio Ambient mesh because the default ztunnel only handles L4 traffic. Waypoint proxies provide the L7 traffic evaluation required to enforce granular access controls based on HTTP methods and paths.

You restrict HTTP methods and paths in Istio by defining an AuthorizationPolicy with targetRefs attached to a waypoint. This enforces principal-based access control for specific HTTP requests like POSTing to designated paths.

Yes, you can secure service access in Kubernetes without sidecar proxies by using Istio Ambient mode. You deploy waypoint gateways and apply AuthorizationPolicy resources with targetRefs to enforce L7 access controls directly.

You label a Kubernetes service to route traffic through an Istio waypoint by applying the appropriate service labels. This directs the service traffic through the configured waypoint gateway for L7 inspection and policy enforcement.