rlay, to full L7 processing — on a per-namespace basis, as needed. Furthermore, workloads running in different ambient layers, or with sidecars, interoperate seamlessly, allowing users to mix and match capabilities based on the particular needs as they change over time.</p><h2 id=building-an-ambient-mesh>Building an ambient mesh</h2><p>Istio&rsquo;s ambient data plane mode uses a shared agent, running on each node in the Kubernetes cluster. This agent is a zero-trust tunnel (or <strong><em>ztunnel</em></s