Quick Takeaways
What you'll learn in this article
- 1
Service mesh adoption dropped from 50 to 42 percent as the ecosystem pivots away from sidecars
- 2
This guide covers Istio Ambient Mesh GA, Cilium eBPF mesh after Cisco's Isovalent acquisition, Linkerd's licensing controversy, AWS App Mesh deprecation, Kubernetes Gateway API, zero-trust networking, and the convergence reshaping cloud-native communication
Keep reading for detailed implementation, code examples, and real-world results
Updated (February 2026): Complete rewrite replacing generic service mesh overview with current data including Istio Ambient Mesh GA, Cilium eBPF mesh capabilities after Cisco's Isovalent acquisition, Linkerd licensing changes, AWS App Mesh deprecation, Kubernetes Gateway API adoption, Envoy Gateway, multi-cluster mesh patterns, zero-trust networking trends, and the sidecar fatigue narrative.
The Sidecar Is No Longer the Default
For years, service mesh meant one thing: a sidecar proxy deployed alongside every pod in your cluster. Istio popularized the pattern with Envoy proxies, Linkerd optimized it with a lightweight Rust proxy, and the industry accepted the resource overhead as the cost of doing business.
That era is ending. CNCF's 2024 annual survey shows service mesh adoption dropped from 50 percent to 42 percent, driven by operational overhead concerns. But the technology is not dying — it is being rebuilt from the ground up.
Three converging forces are reshaping service mesh architecture: Istio's Ambient Mesh removes per-pod sidecars entirely, Cilium moves mesh functionality into the Linux kernel via eBPF, and the Kubernetes Gateway API standardizes traffic management across implementations. The result is a service mesh that is lighter, faster, and increasingly invisible.
Service Mesh Adoption
42%
Organizations using service mesh in production, down from 50 percent in 2023. Kubernetes production use rose to 80 percent in the same period (CNCF Annual Survey 2024)
Istio: Ambient Mesh Changes Everything
Istio, the most widely adopted service mesh in production, achieved CNCF Graduated status in July 2023. The latest release is v1.28.3 (January 2026), with roughly quarterly minor releases. But the headline feature since late 2024 is Ambient Mesh — and it fundamentally changes what Istio looks like in production.
How Ambient Works
Traditional Istio deploys an Envoy sidecar proxy alongside every pod in the mesh. Ambient Mesh replaces this with two layers:
ztunnel — a lightweight, shared Layer 4 node proxy that handles mTLS encryption and identity verification for all pods on a node. One ztunnel per node instead of one sidecar per pod.
Waypoint proxies — optional Layer 7 proxies deployed only where advanced traffic management (routing, retries, rate limiting, authorization policies) is needed. Most services only need L4, so most services never get a waypoint proxy.
Ambient Mesh reached General Availability in Istio v1.24 (November 2024), with ztunnel, waypoints, and all APIs marked Stable.
Performance Impact
The numbers are dramatic. Compared to sidecar mode, Ambient delivers over 90 percent memory reduction and over 50 percent CPU reduction. In default L4 mode, ztunnel adds approximately 0.17ms and 0.20ms to 90th and 99th percentile latency respectively — negligible for most workloads.
An academic benchmark at 3,200 requests per second found that Ambient's mTLS adds only 8 percent latency overhead, compared to 166 percent for traditional Istio sidecars. At higher traffic volumes, ambient mode provides up to 25 percent lower latency and higher throughput than sidecar configurations.
Multi-Cluster and Roadmap
Multi-cluster ambient mesh reached Alpha in Istio 1.27 (August 2025) and is a major roadmap priority. Istio has no intention of ending sidecar support — sidecars remain the right choice for specific workloads that need per-pod L7 control — but ambient is now the recommended starting point for new installations.
Istio: Sidecar vs. Ambient Mode
Traditional Sidecar
Ambient Mesh (GA Nov 2024)
Cilium: eBPF in the Kernel
Cilium takes the most radical approach: move service mesh functionality directly into the Linux kernel using eBPF. No sidecar proxies. No node-level proxy daemons. The data plane runs in kernel space.
CNCF Graduated and Cisco Acquisition
Cilium achieved CNCF Graduated status in October 2023 — the first project to graduate in the cloud-native networking category. It ranks second in CNCF project commit activity behind only Kubernetes, with over 800 individual contributors.
Cisco completed its acquisition of Isovalent (the company behind Cilium) on April 12, 2024. Cisco committed to maintaining Cilium and Tetragon (the eBPF security observability project) as open-source projects with an independent advisory board. Production users include Adobe, Capital One, and Google.
v1.19: A Decade of eBPF
Cilium v1.19 (February 2026) is a milestone release celebrating ten years since the first commit. Over 2,934 commits from 1,010+ developers went into this release. Key additions include ztunnel support in beta (enabling transparent mTLS encryption per namespace) and Gateway API v1.4.0 conformance.
Performance Trade-offs
Cilium has the best CPU consumption of all tested meshes — no per-pod proxy overhead means less compute wasted on mesh infrastructure. However, the picture is nuanced: Cilium's mTLS latency overhead is 99 percent at 3,200 RPS (higher than Ambient's 8 percent), though Cilium outperforms at 12,800 RPS high-traffic scenarios. Memory consumption per node is higher than Linkerd and Istio Ambient, but efficiency improves in clusters with many pods per node.
One important caveat: Cilium disables network encryption for intra-node traffic by design. If your threat model requires encryption between pods on the same node, Istio or Linkerd is the safer choice.
Linkerd: Performance Leader, License Controversy
Linkerd maintains the best raw latency performance of any service mesh. In 2025 benchmarks, Linkerd is 163ms faster than sidecar Istio at the 99th percentile and maintains an 11.2ms lead over Istio Ambient. Linkerd claims 1.2 percent network overhead versus Istio's 3.8 percent. In a 1,000-microservice scalability test, Linkerd achieved a 99.8 percent request success rate with under 5ms latency.
The Licensing Change
In February 2024, Buoyant (Linkerd's creator) announced that stable releases would no longer be freely downloadable starting with Linkerd 2.15. The source code remains Apache v2 licensed — fully open source on GitHub. But pre-built stable binaries are now only available through Buoyant Enterprise for Linkerd (BEL), which is free for individuals and businesses with fewer than 50 employees. Larger organizations must pay.
The community reaction was significant. Some users viewed this as paywalling an open-source project. Buoyant's CEO stated the paywall "worked" for sustainability. Users can still build from source, but this is operationally burdensome for most organizations. Edge releases remain freely available.
Recent Releases
Linkerd 2.19 (October 2025) introduced post-quantum cryptography — a modernized TLS stack using post-quantum key exchange algorithms by default. Linkerd 2.18 (April 2025) focused on reducing operational pain with the "Battlescars" release. Linkerd 2.17 (December 2024) added egress control, rate limiting, and federated services.
P99 Latency Overhead (ms, lower is better)
| mesh | p99Latency |
|---|---|
| Linkerd | 11.2 |
| Istio Ambient | 22.4 |
| Cilium eBPF | 28.6 |
| Istio Sidecar | 174.2 |
Envoy and the Gateway API
Envoy: The Universal Data Plane
Envoy (CNCF Graduated November 2018, originally built at Lyft) serves as the data plane for Istio, Consul Connect, and numerous other mesh implementations. The latest release is v1.37.0 (January 2026).
Envoy Gateway reached 1.0 GA and continues active development at v1.6.0. It implements the Kubernetes Gateway API and can serve as both the ingress gateway and waypoint proxy for Istio ambient mesh. WASM extensions allow dynamic loading of custom logic packaged as OCI images — enabling per-request transformations, authentication, and observability without recompiling the proxy.
Gateway API: The Mesh Standard
The Kubernetes Gateway API v1.4.0 (October 2025) is described as "the next generation of Kubernetes Ingress, Load Balancing, and Service Mesh APIs." The GAMMA (Gateway API for Mesh Management and Administration) initiative has been part of the Standard Channel since v1.1.0 and is considered GA.
Seven implementations were already conformant with v1.4.0 at release time, including Istio, Cilium, Linkerd, Envoy Gateway, and Kong/Kuma. OpenShift 4.19+ includes Gateway API CRDs by default.
Key capabilities: BackendTLSPolicy for TLS between gateways and backends (Standard), percentage-based request mirroring (Standard), CORS filters, gateway merging, and retry budgets. The Gateway API is steadily absorbing configuration that previously required mesh-specific CRDs, reducing vendor lock-in.
AWS App Mesh: Deprecated
AWS officially deprecated App Mesh with an end-of-life date of September 30, 2026. Since September 24, 2024, new customers cannot onboard. The replacement is Amazon VPC Lattice — a fully managed application networking service that operates at Layer 7 without sidecar proxies.
VPC Lattice provides built-in service discovery, load balancing, weighted routing for blue/green and canary deployments, IAM-based policies, and TLS encryption. It works across VPCs and AWS accounts, supporting EC2, ECS, EKS, and Lambda workloads. For EKS users, AWS recommends migrating to VPC Lattice. For ECS users, Amazon ECS Service Connect is the recommended path.
The deprecation signals a broader industry trend: managed, opinionated networking services replacing self-managed mesh infrastructure for cloud-specific workloads.
Consul Connect After IBM
IBM completed its $6.4 billion acquisition of HashiCorp on February 27, 2025. Consul's latest version is 1.22.0 (October 2025). Like all HashiCorp products, Consul switched from MPL 2.0 to BSL (Business Source License) in August 2023 — a license not recognized as open source by the OSI.
IBM's primary service mesh investment appears to be Istio via Red Hat OpenShift Service Mesh, not Consul. However, deeper integration of Consul with IBM's networking portfolio is expected, particularly for edge computing and multi-cloud use cases. Unlike Terraform (which spawned OpenTofu), there is no widely adopted open-source fork of Consul.
Service Mesh Production Usage (Estimated, 2026)
| Name | Value |
|---|---|
| Istio | 47 |
| Cilium | 20 |
| Linkerd | 15 |
| Consul Connect | 10 |
| Other / Custom | 8 |
Multi-Cluster and Multi-Cloud Mesh
Multi-cluster is where service mesh complexity peaks — and where the value proposition is strongest.
Istio supports configuring a mesh spanning multiple clusters, with workloads reaching each other directly (shared network) or via Istio gateways (different networks). Multi-cluster ambient mesh is Alpha as of Istio 1.27.
Cilium Cluster Mesh provides inter-cluster pod-to-pod connectivity without gateways or central proxy bottlenecks. Each node handles cross-cluster traffic directly. It requires IP connectivity between all nodes across clusters but provides transparent service discovery via standard Kubernetes services and CoreDNS, plus encryption in transit between nodes.
Cilium plus Istio is an emerging pattern: Cilium serves as the CNI layer while Istio handles the service mesh control plane, combining eBPF efficiency with Istio's feature set.
Zero-Trust Networking
Service meshes provide the foundational building blocks for zero-trust architectures: automatic mTLS between all services (encrypted and authenticated without application changes), cryptographically-enforced workload identity via SPIFFE/SPIRE, and fine-grained identity-based authorization policies.
The 2026 trend is "identity over network" — the recognition that most zero-trust initiatives stall because they protect the network, not the workload. True zero trust requires verified identity at every request and eliminating static credentials entirely. JWT tokens, OAuth, and SAML are being extended to service-to-service communication. Service meshes are the natural enforcement layer for this model.
By 2025, over 50 percent of enterprise applications reportedly use service mesh technology for service-to-service communication, up from under 10 percent in 2021. Key management and certificate lifecycle remain the largest operational risk — expired certificates and mis-rotated keys become "outage multipliers."
When You Might Not Need a Mesh
Not every Kubernetes deployment needs a service mesh, and the alternatives have matured.
gRPC-native load balancing — gRPC breaks standard connection-level load balancing because HTTP/2 multiplexes requests over a single TCP connection. Solutions include headless Kubernetes services with DNS-based client-side balancing and setting MAX_CONNECTION_AGE to force periodic reconnection.
Kubernetes native features are absorbing mesh capabilities. The EndpointSlice API is now official (Endpoints API deprecated in Kubernetes 1.33, April 2025). Topology-aware routing gained new PreferSameZone and PreferSameNode strategies. Gateway API provides standardized L4/L7 routing.
Managed cloud services — AWS VPC Lattice, Google Cloud Traffic Director, and similar offerings provide mesh-like capabilities without self-managed infrastructure. These work for cloud-specific workloads but do not solve multi-cloud or hybrid scenarios.
Modern load balancers — Traefik v3 with native Gateway API, gRPC, and HTTP/3 support, or standalone Envoy deployments, can handle traffic management needs without a full mesh.
The Sidecar Era Begins
Istio launches (2017) with Envoy sidecars. Linkerd pioneers the service mesh category. Envoy graduates at CNCF (2018). Every pod gets a proxy. The overhead is accepted as necessary.
Ecosystem Growth
Consul Connect adds mesh capabilities. AWS launches App Mesh. Service mesh adoption climbs toward 50 percent. Cilium begins eBPF-based mesh experiments. CNCF surveys show growing interest.
The Turning Point
Istio and Cilium graduate at CNCF (2023). HashiCorp switches to BSL license. Sidecar fatigue emerges. Istio announces ambient mesh. Cisco acquires Isovalent (Cilium). The sidecar-free movement gains momentum.
Ambient Goes GA
Istio Ambient Mesh reaches GA (November). Linkerd paywalls stable releases (February). AWS deprecates App Mesh. Gateway API matures with GAMMA for mesh. Adoption drops from 50 to 42 percent.
Post-Sidecar Architecture
IBM acquires HashiCorp. Cilium 1.19 adds ztunnel beta. Multi-cluster ambient reaches alpha. Gateway API v1.4 with seven conformant implementations. VPC Lattice replaces App Mesh. Sidecars become targeted, not default.
The service mesh is not dying — it is shedding its skin. The sidecar proxy, once the defining architectural element, is being replaced by lighter alternatives: shared node proxies in Istio Ambient, kernel-level eBPF programs in Cilium, and managed cloud services like VPC Lattice. The 42 percent adoption rate reflects not rejection of the concept but rejection of the overhead. As ambient mesh matures, eBPF performance improves, and the Gateway API absorbs more configuration, the service mesh is becoming what it always should have been — invisible infrastructure that handles mTLS, observability, and traffic management without requiring a proxy container alongside every workload in the cluster.
