Envoy is a mature battle-tested piece of software used by the world&rsquo;s largest network operators, it is likely less vulnerable than the applications it runs alongside.</p><p>While the ztunnel is a shared resource, it only has access to the keys of the workloads currently on the node it’s running.
Thus, its blast radius is no worse than any other encrypted CNI that relies on per-node keys for encryption.
Also, given the ztunnel’s limited L4 only attack surface area and Envoy’s aforementioned secur