 an alternative to a &amp;lt;a href=&amp;#34;/docs/reference/glossary/#sidecar&amp;#34;&amp;gt;sidecar mode&amp;lt;/a&amp;gt; deployment.&amp;lt;/p&amp;gt;
">ambient</span> mode.</p>
'>CNI</span> installed in your cluster. Istio is not a CNI, and does not enforce or manage <code>NetworkPolicy</code>, and in all cases respects it - ambient does not and will never bypass Kubernetes <code>NetworkPolicy</code> enforcement.</p><p>An implication of this is that it is possible to create a Kubernetes <code>NetworkP