Skip to content

Key concepts

Page as Markdown 

    

  
  


              
            

          

          
          
Understand the key concepts behind ambient mesh, including Gateway API, HBONE tunneling, ztunnel, waypoints, and xDS configuration.

          
Configuration
    
Gateway API
    
The Gateway API is a collection of APIs that are part of Kubernetes, focusing on traffic routing and management. The APIs are inspired by, and serve many of the same roles as, Kubernetes’ Ingress and Istio’s legacy VirtualService and Gateway APIs.


In ambient mesh, the Gateway API configures gateways and waypoints: at the edge of the mesh, and at the edge of a service inside the mesh, respectively.


Services and endpoints
    
At the highest level, a service is a grouping of replicas of an application. Each replica normally has its own endpoint (IP address), and the service provides an IP address or DNS name to load-balance connections.


You can break this concept into two facets:


    

  • 

    The frontend of the Service is the combination of the cluster IP and its DNS name.
    

    • 

  • 

    The backend of the Service is the collection of endpoint IPs.
    

    • 



Learn more about service facets in the Gateway API.


Implementation details
    
The following terms appear throughout the documentation and are helpful for debugging, but you do not need to understand them to configure ambient mesh.


HBONE
    
HBONE (HTTP-Based Overlay Network Environment) is a secure tunneling protocol used in ambient mesh. HBONE transparently multiplexes TCP streams from many different application connections over a single, mTLS-encrypted network connection (an encrypted tunnel).


HBONE is Istio’s name for the combination of three open standards:



HTTP CONNECT establishes a tunnel connection, mTLS secures and encrypts that connection, and HTTP/2 multiplexes application connection streams over that secured and encrypted tunnel and conveys additional stream-level metadata.


HBONE is traditionally sent over port 15008.


xDS
    
The xDS APIs are a data plane configuration API. “DS” stands for Discovery Service, and “x” refers to the many various features of the data plane that can be configured, including endpoints, listeners, routes, and secrets.


xDS communicates configuration and environmental state between the istiod control plane and the ambient data plane proxies (ztunnel and waypoints).


        

        

  

Architecture