Bootcamp Overview

This bootcamp provides a deep dive into the security and traffic routing capabilities of Istio Ambient, the next-generation service mesh architecture that completely eliminates the need for sidecar proxies. You will learn how to secure service-to-service communication without the traditional architectural overhead.

Through hands-on implementation, you will master end-to-end security, zero-trust policies, traffic management, and deep observability across distributed systems. By working with real-world scenarios, you will learn how to stabilize microservices and prevent common failure modes in production.

Key Takeaways By the end of the bootcamp, you will be fully prepared to lead service mesh initiatives that balance high-security requirements with operational simplicity across both Kubernetes clusters and virtual machines. You will leave equipped with:

• Ready-to-deploy scripts and code samples.

• Expert cheat sheets for operating Istio Ambient.

Day 1: Security & Identity

Fundamentals

• Introduction to Service Mesh and Istio Ambient
• Ambient vs. Classic: Key benefits and architectural shifts
• Istio Ambient and the Zero-Trust model

Ingress Gateway & TLS

• Implementing Ingress with TLS and mTLS termination
• Security hardening for entry points
• Troubleshooting Ingress connectivity

Peer & Request Authentication

• Activating mTLS for the entire mesh
• Workload coexistence: mTLS and legacy traffic
• End-user Auth: Preparing JWT, JWKS, and claim-based routing

Authorization & Egress

• Defining AuthorizationPolicy: Deny-all vs. Explicit Allow
• Policy testing with Dry Run and best practices
• Egress Gateway: Controlling access to external services
• Istiod Certificate and identity management

Day 2: Traffic & Operations

Building the Mesh

• Service configuration and deployment in Kubernetes
• Core Traffic Rules: Gateway, VirtualService, and DestinationRule
• Observability: Visualizing the mesh with Kiali, Jaeger, and Grafana

Resilience & Metrics

• Distributed tracing: Tracing on demand and data limiting
• Performance monitoring with Prometheus metrics
• Resilience testing: Mesh-level vs. application-level implementations

Advanced Operations

• A/B Testing: Implementing traffic shifting and mirroring
• Canary Releasing: Controlled evolution of your services
• Operational best practices for long-term mesh health

Audience & Requirements

• Designed for developers, architects, and security engineers managing microservices with high security demands
• Ideal for teams operating in Kubernetes clusters who need to move beyond basic networking to zero-trust security
• Prior experience with Kubernetes is helpful to get the most out of the hands-on Istio Ambient implementation
• Bring your technical blockers: we’ll cover real-world traffic management, mTLS, and auth policies
• Come ready to build: you’ll receive slides, code samples, and scripts to deploy your own mesh live