Service meshes have long been a critical component of Kubernetes-based platforms, especially in enterprise environments where consistency, security, and observability are paramount. On Red Hat OpenShift, service meshes provide a standardized approach to managing service-to‑service communication across increasingly complex microservices architectures.

For years, the sidecar architecture defined how service meshes operated on OpenShift. By injecting an Envoy proxy alongside every application pod, OpenShift Service Mesh delivered powerful features such as fine-grained traffic control and deep observability. However, as clusters scaled, the operational cost became more. Each workload incurred the cost of an extra container, leading to higher memory usage and greater resource consumption.

Configuration updates often required pod restarts, thereby adding friction for platform teams responsible for stability and uptime in production environments.

The ambient mode was introduced in response to these challenges. Rather than pushing networking complexity into every application pod, the ambient mode adopts a sidecar‑less architecture. The data plane is moved into the infrastructure layer, allowing applications to join the mesh without invasive proxy injection. This architectural shift is now fully supported in the Red Hat ecosystem. With the release of Red Hat OpenShift Service Mesh 3.2, the core components of the Istio ambient mode are Generally Available (GA). These include Ztunnel (which provides secure Layer 4 connectivity across the mesh) and waypoint proxies (which handle Layer 7 traffic management and policy enforcement where needed). Workloads can be onboarded to the mesh with minimal disruption. Resource cost is reduced by removing per‑pod sidecars, and operational complexity is simplified by centralizing data plane concerns. At the same time, organizations retain the security, visibility, and control they expect from OpenShift Service Mesh, now with greater flexibility and scalability.

In this blog, we'll deploy the Bookinfo sample application and use it to demonstrate how the ambient mode simplifies service mesh management on OpenShift.

Bookinfo sample application: Benefits of Istio ambient mode (without sidecar injection)

The following table depicts the advantages of the Istio ambient mode and how it benefits the Bookinfo application.

Prerequisites

Before you begin installation, ensure that your environment meets the following prerequisites:

• OpenShift 4.19 and later: Must include supported Kubernetes Gateway API custom resource definitions (CRDs) required for the Istio ambient mode.
• Admin access: User must log in to the cluster through the oc CLI with cluster-admin privileges.
• IstioCNI: Ensure that the IstioCNI resource is created, and all pods are active.
• Ztunnel: Ensure Ztunnel resource is created, and pods are active across the cluster.
• Ambient mode: Make sure to install Istio ambient mode.

Steps to install the Bookinfo sample application

1. Run the following command to create the bookinfo namespace:

   $ oc create namespace bookinfo

2. Run the following command to add the istio-discovery=enabled label to the bookinfo namespace:
   

   $ oc label namespace bookinfo istio-discovery=enabled

3. Apply the bookinfo.yaml file to deploy the Bookinfo application. The contents of the YAML file are as follows:
   

   # Copyright Istio Authors
   # 
   #   Licensed under the Apache License, Version 2.0 (the "License");
   #   you may not use this file except in compliance with the License.
   #   You may obtain a copy of the License at
   #
   #       http://www.apache.org/licenses/LICENSE-2.0
   #
   #   Unless required by applicable law or agreed to in writing, software
   #   distributed under the License is distributed on an "AS IS" BASIS,
   #   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   #   See the License for the specific language governing permissions andR
   #   limitations under the License.
   
   ##################################################################################################
   # This file defines the services, service accounts, and deployments for the Bookinfo sample.
   #
   # To apply all 4 Bookinfo services, their corresponding service accounts, and deployments:
   #
   #   kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml
   #
   # Alternatively, you can deploy any resource separately:
   #
   #   kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml -l service=reviews # reviews Service
   #   kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml -l account=reviews # reviews ServiceAccount
   #   kubectl apply -f samples/bookinfo/platform/kube/bookinfo.yaml -l app=reviews,version=v3 # reviews-v3 Deployment
   ##################################################################################################
   
   ##################################################################################################
   # Details service
   ##################################################################################################
   apiVersion: v1
   kind: Service
   metadata:
     name: details
     labels:
       app: details
       service: details
   spec:
     ports:
     - port: 9080
       name: http
     selector:
       app: details
   ---
   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: bookinfo-details
     labels:
       account: details
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: details-v1
     labels:
       app: details
       version: v1
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: details
         version: v1
     template:
       metadata:
         labels:
           app: details
           version: v1
       spec:
         serviceAccountName: bookinfo-details
         containers:
         - name: details
           image: quay.io/maistra/examples-bookinfo-details-v1:2.6.0-ibm-p
           imagePullPolicy: IfNotPresent
           ports:
           - containerPort: 9080
   ---
   ##################################################################################################
   # Ratings service
   ##################################################################################################
   apiVersion: v1
   kind: Service
   metadata:
     name: ratings
     labels:
       app: ratings
       service: ratings
   spec:
     ports:
     - port: 9080
       name: http
     selector:
       app: ratings
   ---
   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: bookinfo-ratings
     labels:
       account: ratings
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: ratings-v1
     labels:
       app: ratings
       version: v1
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: ratings
         version: v1
     template:
       metadata:
         labels:
           app: ratings
           version: v1
       spec:
         serviceAccountName: bookinfo-ratings
         containers:
         - name: ratings
           image: quay.io/maistra/examples-bookinfo-ratings-v1:2.6.0-ibm-p
           imagePullPolicy: IfNotPresent
           ports:
           - containerPort: 9080
   ---
   ##################################################################################################
   # Reviews service
   ##################################################################################################
   apiVersion: v1
   kind: Service
   metadata:
     name: reviews
     labels:
       app: reviews
       service: reviews
   spec:
     ports:
     - port: 9080
       name: http
     selector:
       app: reviews
   ---
   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: bookinfo-reviews
     labels:
       account: reviews
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: reviews-v1
     labels:
       app: reviews
       version: v1
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: reviews
         version: v1
     template:
       metadata:
         labels:
           app: reviews
           version: v1
       spec:
         serviceAccountName: bookinfo-reviews
         containers:
         - name: reviews
           image: quay.io/maistra/examples-bookinfo-reviews-v1:2.6.0-ibm-p
           imagePullPolicy: IfNotPresent
           env:
           - name: LOG_DIR
             value: "/tmp/logs"
           ports:
           - containerPort: 9080
           volumeMounts:
           - name: tmp
             mountPath: /tmp
           - name: wlp-output
             mountPath: /opt/ibm/wlp/output
         volumes:
         - name: wlp-output
           emptyDir: {}
         - name: tmp
           emptyDir: {}
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: reviews-v2
     labels:
       app: reviews
       version: v2
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: reviews
         version: v2
     template:
       metadata:
         labels:
           app: reviews
           version: v2
       spec:
         serviceAccountName: bookinfo-reviews
         containers:
         - name: reviews
           image: quay.io/maistra/examples-bookinfo-reviews-v2:2.6.0-ibm-p
           imagePullPolicy: IfNotPresent
           env:
           - name: LOG_DIR
             value: "/tmp/logs"
           ports:
           - containerPort: 9080
           volumeMounts:
           - name: tmp
             mountPath: /tmp
           - name: wlp-output
             mountPath: /opt/ibm/wlp/output
         volumes:
         - name: wlp-output
           emptyDir: {}
         - name: tmp
           emptyDir: {}
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: reviews-v3
     labels:
       app: reviews
       version: v3
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: reviews
         version: v3
     template:
       metadata:
         labels:
           app: reviews
           version: v3
       spec:
         serviceAccountName: bookinfo-reviews
         containers:
         - name: reviews
           image: quay.io/maistra/examples-bookinfo-reviews-v3:2.6.0-ibm-p
           imagePullPolicy: IfNotPresent
           env:
           - name: LOG_DIR
             value: "/tmp/logs"
           ports:
           - containerPort: 9080
           volumeMounts:
           - name: tmp
             mountPath: /tmp
           - name: wlp-output
             mountPath: /opt/ibm/wlp/output
         volumes:
         - name: wlp-output
           emptyDir: {}
         - name: tmp
           emptyDir: {}
   ---
   ##################################################################################################
   # Productpage services
   ##################################################################################################
   apiVersion: v1
   kind: Service
   metadata:
     name: productpage
     labels:
       app: productpage
       service: productpage
   spec:
     ports:
     - port: 9080
       name: http
     selector:
       app: productpage
   ---
   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: bookinfo-productpage
     labels:
       account: productpage
   ---
   apiVersion: apps/v1
   kind: Deployment
   metadata:
     name: productpage-v1
     labels:
       app: productpage
       version: v1
   spec:
     replicas: 1
     selector:
       matchLabels:
         app: productpage
         version: v1
     template:
       metadata:
         annotations:
           prometheus.io/scrape: "true"
           prometheus.io/port: "9080"
           prometheus.io/path: "/metrics"
         labels:
           app: productpage
           version: v1
       spec:
         serviceAccountName: bookinfo-productpage
         containers:
         - name: productpage
           image: quay.io/maistra/examples-bookinfo-productpage-v1:2.6.0-ibm-p
           imagePullPolicy: IfNotPresent
           ports:
           - containerPort: 9080
           volumeMounts:
           - name: tmp
             mountPath: /tmp
         volumes:
         - name: tmp
           emptyDir: {}
   ---

   Run the following command to deploy the bookinfo.yaml file:

    oc apply -n bookinfo -f bookinfo.yaml 

4. Run the following command to apply the bookinfo-versions.yaml file to deploy the Bookinfo application:
   

   oc apply -n bookinfo -f https://raw.githubusercontent.com/openshift-service-mesh/istio/release-1.26/samples/bookinfo/platform/kube/bookinfo-versions.yaml

5. Run the following command to verify that the bookinfo pods are running:
   

   $ oc -n bookinfo get pods

   
   

   Note that instead of two pods only one pod is seen, eliminating the need for proxy pods.

6. Run the following command to verify that the Bookinfo application is running:
   

   $ oc exec "$(oc get pod -l app=ratings -n bookinfo  -o jsonpath='{.items[0].metadata.name}')"  -c ratings -n bookinfo  -- curl -sS productpage:9080/productpage | grep -o "<title>.*</title>"

7. Add the Bookinfo application to the Istio ambient mesh by labelling either the entire namespace or the individual pods. To include all the workloads in the bookinfo namespace, apply the istio.io/dataplane-mode=ambient label to the bookinfo namespace, by running the following command:
   

   $ oc label namespace bookinfo istio.io/dataplane-mode=ambient

8. Run the following command to check pods:
   

   $ oc -n bookinfo get pods

We see that the existing pods in bookinfo namespace do not restart. No changes to YAML, images, or entrypoints is needed and Bookinfo application becomes transparently available and is part of the mesh immediately.

Conclusion

The general availability (GA) of ambient mode in OpenShift Service Mesh 3.2 marks an important milestone. The ambient mode offers a modern, efficient path forward for service mesh deployments on OpenShift.

Deploying the Bookinfo application using the Istio ambient mode clearly illustrates a meaningful shift in how cloud-native networking can be delivered on OpenShift. By moving proxy responsibilities out of individual application pods and into the node level Ztunnel, we can dramatically reduce the traditional cost associated with sidecars. There’s no need to alter deployment manifests, inject proxies, or trigger disruptive pod restarts. Applications remain untouched while transparently benefitting from the mesh.

The result is a more efficient use of cluster resources, allowing compute and memory to be focused on your business workloads rather than networking infrastructure. This sidecar‑less approach lowers operational complexity and removes many of the barriers that previously slowed service mesh adoption.

AI disclosure: Portions of this blog were generated with support from an AI assistant. The author reviewed, tested, and refined all material to ensure accuracy, completeness, and compliance with IBM’s technical and editorial standards.