stretch src=/v1.21/blog/2023/traffic-for-ambient-and-sidecar/ambient-to-sidecar.png alt="Ambient mode sleep to Sidecar mode httpbin"></a></div><figcaption>Ambient mode sleep to Sidecar mode httpbin</figcaption></figure><p>ztunnel will be deployed as a DaemonSet in istio-system namespace if ambient mode is enabled, while istio-cni and ztunnel would generate iptables rules and routes for both the ztunnel pod and pods on each node.</p><p>All network traffic coming in/out of the pod with ambient mode enabled wi