Datapath & components
N-S: Client → ingress GW → sidecar(dst) → app. E-W: App → sidecar(src) → sidecar(dst) → app, two Envoy hops (ambient: ztunnel → ztunnel, +waypoint for L7). mTLS handshake only on connect.
istiod: Pilot/Citadel/Galley combined, xDS push + CA. Data plane: Envoy sidecar (mutating webhook) or ambient ztunnel (Rust, L4) + optional waypoint (Envoy, L7). Gateway: dedicated Envoys, Deployment + LB service.
Envoy version = Istio version + 8. Istio 1.31 → Envoy 1.39.
Install profiles
default (prod), minimal (istiod only),
ambient (sidecar-less), remote
(MC workload cluster), demo (noisy). Canary via
--revision=1-31-1.
istioctl x precheck istioctl install --set profile=default \ --set hub=registry.example.com/istio # mirror