based on the particular needs as they change over time.</p><h2 id=building-an-ambient-mesh>Building an ambient mesh</h2><p>Ambient mesh uses a shared agent, running on each node in the Kubernetes cluster. This agent is a zero-trust tunnel (or <strong><em>ztunnel</em></strong>), and its primary responsibility is to securely connect and authenticate elements within the mesh. The networking stack on the node redirects all traffic of participating workloads through the local ztunnel agent. This fully separates 