ten deploy a mesh to enable a zero-trust security posture as a first-step and then selectively enable L7 capabilities as needed. Ambient mode allows those users to bypass the cost of L7 processing entirely when it’s not needed.</li></ul><h2 id=resource-overhead>Resource overhead</h2><p>Overall we expect Istio&rsquo;s ambient mode to have fewer and more predictable resource requirements for most users.
The ztunnel’s limited responsibilities allows it to be deployed as a shared resource on the node.
This 