SOLO ENTERPRISE FOR

Agentic Infrastructure

[agentgateway](/content/products/agentgateway/index.html) [agentregistry](/content/products/agentregistry/index.html) [kagent](/content/products/kagent/index.html)

Cloud Connectivity

[Istio](/content/products/istio/index.html) [kgateway](/content/products/kgateway/index.html)

Get started with Solo

[Get Started](/content/get-started/index.html)

Get started with Solo

[Get Started](/content/get-started/index.html)

Get started with Solo

[Get Started](/content/get-started/index.html)

[Gloo Mesh](/content/global-category-product/gloo-mesh/index.html)

_With the introduction of Istio’s ambient data plane mode, platform teams can efficiently adopt service mesh features and offer enhanced functionality with minimal resource and overhead impact to end consumers._

## What is Istio Ambient Mode?

Istio’s [ambient mode](/content/blog/istio-ambient-mesh-evolution-service-mesh/index.html) was first announced in September 2022. It is a new data plane mode — without sidecars — designed for simplified operations, broader application compatibility, and reduced infrastructure cost. Ambient mode splits Istio’s functionality into two distinct layers: the zero-trust secure overlay layer (the _ztunnel_), and the optional Layer 7 processing layer (the _waypoint_). Compared with sidecars, the layered approach allows users to adopt Istio incrementally from no mesh, to mTLS-based zero-trust overlay, to full L7 processing, as needed. This gives service mesh users two outstanding options from the same dedicated community: Istio with its traditional sidecar approach, or sidecarless ambient mode.

In this blog, we will explore example scenarios related to resourcing costs and operational challenges that often create tension when adopting a service mesh. We will also discuss how adopting ambient mode can address these challenges and improve the platform’s Total Cost of Ownership (TCO).

You can learn more information about ‘Ambient Mode’ in Istio [here](/content/topics/istio/ambient-mode/index.html).

## Istio’s Ambient Mode Reduces Resource Costs

By default, Istio recommends allocating 0.1 CPU cores and 128MB of memory per sidecar. Whilst the advantages of service mesh are well understood, the resource requirements can accumulate quickly for real production workloads.

For teams with a tight budget, complying with this requirement presents significant opportunity costs. They face trade-offs such as deciding between hiring additional staff or investing in other areas of the business versus bearing the increased cost of resources for the application becomes a critical consideration.

In your research about the service mesh, you will have learned about the array of Layer 7 capabilities, including:

- Advanced traffic management and routing control
- Fine-grained security policies at the application layer
- Efficient handling of circuit breaking and fault tolerance mechanisms
- Facilitated implementation of service discovery and dynamic service routing
- Simplified deployment of A/B testing and canary release strategies

However, what if you don’t need these capabilities in the near-term, or for every service you operate? These features might be considered a value-add, and may not match your level of organizational need or maturity.

Let’s consider a few challenging scenarios related to the cost of implementing a service mesh:

#### Scenario 1: Control spiraling sidecars costs

_“Our security team has mandated a zero-trust posture across the entire organization, and as a result we are looking to adopt a service mesh. However, we have discovered that the sidecar approach will incur additional cost (in resource reservations per application)”_

In order to comply with the zero-trust mandate from the security team, with Istio’s ambient mode you no longer need to adopt a sidecar per application. Instead, you can leverage the shared, per-node ztunnel component, which handles the responsibilities of zero-trust networking. You can then opt into safe, per-namespace Layer 7 policy handling when you are ready, or just for the services for which it is needed. This opt-in approach means that the incremental cost from non-mTLS to adopting mTLS is now much lower.

#### Scenario 2: Reduce replicated resourcing costs

_“Our organization requires that development, testing, and staging environments replicate the production setup to catch issues early and maintain high-quality releases. Adopting a service mesh means that each environment incurs additional resource and operational overhead, leading to ballooning overall costs”_

We often see customer environments that replicate their production setup, where the lower level environments receive only a small amount of synthetic traffic — or in some cases no traffic at all. This represents a challenge for environment owners to justify the value of running service mesh in these environments with low or no traffic. The resources allocated to sidecar proxies are largely wasted, contributing to inefficient utilization and higher expenses. By removing the sidecar requirement, ambient mode reduces the base resource requirements, making it more cost-efficient to implement zero-trust while replicating production environments as the standard across the entire development lifecycle.

#### Scenario 3: Navigating varying velocity patterns across architectures

_“We have a complex microservice architecture where different services experience widely varying traffic patterns. Some services handle thousands of requests per second (RPS), while others only handle a few hundred. Despite this, the sidecar proxies are generally allocated the same resources across all services, leading to inefficient resource utilization. High-traffic services suffer from performance bottlenecks, while low-traffic services waste resources.”_

Another common scenario we see is that sidecar proxies are typically provisioned with a one-size-fits-all approach, leading to inefficient resource utilization. In the absence of a mechanism (e.g., Istio pod annotations exposed in an application’s Helm chart) to override the default proxy resource reservation requests, as well as the lack of education for development teams on how to effectively use observability data to configure and tune these resource reservations, teams onboarding applications can have varying success depending on their application characteristics. Removing the sidecars entirely eliminates inefficiencies caused by underutilization. Moreover, because ztunnel was designed to be a highly performant component built in Rust, it can still handle the high throughput use-case.

#### Scenario 4: Implementing service mesh to achieve zero-trust in edge environments

_“Deploying a service mesh in resource-constrained edge environments is challenging due to the additional overhead of sidecars.”_

Edge computing processes data closer to the source, often in less secure or untrusted networks, and with limited resources. Implementing zero-trust ensures that every interaction is authenticated and authorized, significantly reducing the risk of breaches but can be difficult in resource-constrained environments. By leveraging Istio’s ambient mode service mesh which does not require the resource overhead of sidecars, edge computing use cases in IoT, retail, and healthcare can realistically consider implementing zero-trust principles and achieve compliance to enhance their security strategy of edge environments.

These are just some common sidecar challenges that Istio’s ambient mode can help resolve. Other resourcing roadblocks that Istio’s ambient mode can help navigate include reducing application downtime experienced with sidecar deployments and solving complexities with egress configurations.

## Istio’s Ambient Mode Helps Simplify Application Operations

‍ _Safely restarting a service to upgrade the sidecar version involves three different settings: controlling Envoy draining and rejecting new connections, grace time for active connections to close, and terminating the pod when all active connections are closed._

One of the most common challenges that we see with service mesh adoption is the increase in operational overhead for an application owner to manage the lifecycle of the sidecar. For example, when upgrading from Istio 1.19 to 1.20, every application pod in the cluster must be restarted to apply the new proxy version. You have to consider draining traffic from workloads, terminating connections, and what happens if a pod doesn’t restart due to a dependency being temporarily unavailable.

All of these considerations go away when adopting a sidecarless service mesh architecture! Ambient mode significantly reduces operational burden, providing developers more time to focus on developing application features rather than the infrastructure-related concerns of managing proxies at scale.

To help contextualize this, let’s consider a few challenging scenarios related to operating a service mesh:

#### Scenario 1: Solving complexity by upgrading Istio deployments

_“We have a complex Istio deployment with many customizations, and upgrading to newer versions has been a major pain point. The upgrade process often results in downtime, configuration drift, and unforeseen issues, which disrupt our operations.”_

The community Istio support timeline currently follows an N-1 support status which equates to upgrading Istio approximately every 7-9 months. Upgrading Istio often can be highly involved, eliminating the sidecar greatly reduces the risk of disrupting business operations simply due to having fewer components to upgrade and manage.

By focusing on node-level management rather than service-level sidecars, operations teams can perform upgrades more efficiently, and with greater confidence without needing to rely on or coordinate with application teams. It is worth considering that operational cost savings can really add up. For example, if the time required for two engineers to complete an Istio upgrade is reduced from 16 hours to just 2 hours, the savings in both time and cost can be substantial.

#### Scenario 2: Limited talent and resourcing available for sidecar management

_“Onboarding new development teams to use the service mesh is time-consuming and requires extensive training on sidecar management.”_

Developers frequently express frustration with managing sidecars, as evidenced by numerous community surveys conducted over the years. Istio’s ambient mode addresses this issue head-on; by eliminating sidecars entirely, there is no need for extensive training on sidecar management. Users of the sidecarless service mesh can trust that if an application is deployed on the cluster, its traffic is inherently encrypted by default.

#### Scenario 3: Integrating legacy applications causes disruptions

_“We have a significant number of legacy applications that are critical to our business operations. Introducing a sidecar-based service mesh disrupts these applications and requires extensive modifications.”_

With Istio’s ambient mode, adding a service to the mesh now only requires a label applied at the namespace or pod. Traffic is then intercepted by ztunnel without restarting the application. This greatly simplifies the onboarding of critical applications that have a low tolerance for disruption or modifications that previously were not considered as strong candidates for the mesh. Application owners no longer need to concern themselves with the presence of a sidecar in their workload, the lifecycle of that sidecar, or the cost of the sidecar resource.

## Comparing the Usage Cost of Ambient Mode

In order to evaluate the resource usage of service mesh, we will deploy a sample application at scale. This is representative of how a user might actually use service mesh in a production environment, and is based on our discussions with our customers about how they are using Istio and Gloo Mesh today.

Our test workloads represent an application configured in a Namespace-Per-Tenant pattern, where each tenant operates in an isolated namespace to ensure resource and security separation. The application is designed with a classic 3-tier fan-out architecture, where an initial service sends requests to multiple downstream services, providing a more representative assessment of expected performance compared to a naive benchmark where a client targets a single service.

We have 8 containers deployed per tenant, grouped into two “apps” with four pods each arranged in three tiers. With 25 tenants in the cluster, we have a total of 200 microservices.

To ensure a “Guaranteed” quality of service class, every application is configured to have the same pod requests and limits: 0.7 CPU cores and 500MB of memory. (The application we are using is [fake-service](https://github.com/nicholasjackson/fake-service), a sample application for testing service mesh built by CNCF TAG Network co-chair Nic Jackson.)

Reflecting the fact that users tend to run their clusters at medium utilization, we set a target of < 30% CPU utilization for our baseline application under load, which worked out to a 21-node cluster with n2-standard-8 instances on Google Cloud.

To generate synthetic load we are using [Vegeta](https://github.com/tsenart/vegeta), with one instance per app (two in each namespace). Four more nodes were utilized for the load generators, sending 200 requests per second to each of the Tier 1 replicas. These requests generate subsequent requests to Tier 2 and Tier 3 along the edges shown, giving a load of 2000 RPS through each tenant and 50000 RPS total across the cluster. We ensure that the latency results we see in our tests are within our defined expectations, with no requests taking more than 10ms at p50 or 15ms at p95.

We took a baseline reading of our application, which we can subtract from the mesh numbers to learn the cost of each option.

Then, we deployed our application with Istio in both sidecars and ambient mode.

[You can find our scripts and our outputs on GitHub](https://github.com/solo-io/doing-more-for-less).

## Istio’s Ambient Mode is over 70% Cheaper than Sidecars

Aside from all the operational savings we laid out above, Istio in ambient mode is substantially cheaper to run than Istio in sidecar mode.

Even in a heavily loaded, well-sized cluster, ambient mode at L4 uses **73% less CPU than sidecar mode**. In our example cluster, Istio in ambient mode requires 1.28 fewer cores per namespace. Given our 25 namespace environment, that equates to a 32 core saving, or the equivalent of 4 8-core machines. That’s a saving of $1100 per month!

What’s more, the CPU utilization is minimal: a mere 4.78% CPU to add mTLS to our workload, compared with 24.3% extra to add sidecars. Assuming you have at least 5% overhead free on all the nodes in your cluster, **you can install Istio in ambient mode without adding any extra nodes, thus making it effectively free to run.**

Users looking to implement full L7 functionality and features with Istio’s ambient mode, can do so with confidence. You can opt in per-namespace where needed, but even when we ran a waypoint each for all the tenants – comparable in features to a full sidecar deployment — we still saw substantial CPU savings. Keep an eye out for our upcoming blog that discusses the cost and value of L7 in more depth.

## In conclusion

Our research validates the goals in building the ambient data plane: simplifying operations of the service mesh (no sidecars), as well as reducing infrastructure costs (substantial cost savings vs. sidecars, minimal additional cost to fulfill mTLS requirement from baseline).

If users decide to adopt the full L7 feature set by adopting waypoint proxies, the resourcing cost is substantially less than traditional sidecar deployments of Istio, not to mention being easier to manage and improving the experience for developers.

Istio’s ambient mode enables users to adopt a sidecarless architecture and perform service mesh in a truly ‘ambient’ manner for developers. You can learn more about how to extend the functionality of Istio’s ambient mode for enterprise architecture and workloads in the latest 2.6 release of Gloo Mesh.

As a co-creator and leader in the development of the Istio ambient data plane, Solo.io is uniquely positioned to help our customers adopt this architecture for production-grade security and compliance requirements. To find out more about how ambient mode can optimize your application services and connectivity, [please reach out and connect with us.](/content/company/contact/index.html)

## Featured content

[See More](/content/blog/index.html)

\\
\\
\\
\\
**The future of Kubernetes is context-aware: Meet Solo Enterprise for kagent** \\
\\
Discover how Solo.io's enterprise version of kagent extends Kubernetes to turn cloud-native infrastructure into agent-native infrastructure.\\
\\
\\
\\
Read Blog](/content/blog/kagent-enterprise/index.html)

\\
\\
\\
\\
**Getting started with Multi-LLM provider routing** \\
\\
\\
\\
Read Blog](/content/blog/getting-started-with-multi-llm-provider-routing/index.html)

\\
\\
**Kgateway Lab: Exposing, Securing, and Rate Limiting with kgateway** \\
\\
Free K8s Gateway Lab: Deploy, Secure, and Rate Limiting with Solo's Open Source Gateway\\
\\
\\
\\
Read Lab](/content/resources/lab/exposing-securing-and-rate-limiting-with-k8s-gateway/index.html)

\\
\\
\\
\\
**kagent <3 Agent Substrate: A 101 installation & Configuration Guide** \\
\\
Learn how to run AI agents on Kubernetes with Agent Substrate and kagent. This step-by-step guide covers architecture, installation, configuration, and deploying agent workloads using the Substrate runtime.\\
\\
\\
\\
Read Blog](/content/blog/kagent-3-agent-substrate-a-101-installation-configuration-guide/index.html)

\\
\\
\\
\\
**Solo Enterprise for Istio 1.30: Agentic Mesh, ztunnel-Native Egress, New UI, and Fine-Grained Workload Identity** \\
\\
This release brings agentgateway into the ambient mesh as a waypoint, ingress, and egress proxy, adds egress controls directly in ztunnel, ships a revamped Solo UI with a new advanced Service Graph, and introduces workload identity that goes beyond the service account.\\
\\
\\
\\
Read Blog](/content/blog/solo-enterprise-for-istio-1-30-agentic-mesh-ztunnel-native-egress-new-ui-and-fine-grained-workload-identity/index.html)

\\
\\
\\
\\
**Agentgateway Code Mode for OpenAPI to MCP** \\
\\
A very common pattern for MCP servers in the enterprise is to wrap existing APIs. We’ve invested 20+ years in building useful, reusable, valuable APIs, should we really be reinventing everything just because a fancy new protocol showed up? Is that even practical? The answer is no. We need to be practical and recognize some fundamental challenges mapping APIs to MCP tools. With agentgateway, we have three ways to expose OpenAPI operations via MCP: direct exposure, custom exposure with optional API chaining, or an AI model-controlled “code mode”.\\
\\
\\
\\
Read Blog](/content/blog/agentgateway-code-mode-for-openapi-to-mcp/index.html)

\\
\\
\\
\\
**From Service Mesh to Agentic Mesh** \\
\\
Service mesh became boring...but it's more foundational than ever before.\\
\\
\\
\\
Read Blog](/content/blog/from-service-mesh-to-agentic-mesh/index.html)

\\
\\
\\
\\
**Keeping Context and Tokens Low With Progressive Disclosure In Agentgateway** \\
\\
Learn how to cut MCP token usage by 91% using agentgateway’s progressive disclosure. Reduce cost, control context bloat, and optimize agent workflows.\\
\\
\\
\\
Read Blog](/content/blog/keeping-context-and-tokens-low-with-progressive-disclosure-in-agentgateway/index.html)

\\
\\
\\
\\
**MCP Progressive Disclosure: Save Tokens, Retrieve Schemas** \\
\\
\\
\\
Read Blog](/content/blog/mcp-progressive-disclosure/index.html)

\\
\\
\\
\\
**Five Minutes to Your First MCP Server Tool: A Quickstart with agentgateway** \\
\\
New to agentic AI? This guide walks you through running agentgateway locally, connecting to MCP servers, and understanding core concepts like rate limiting and observability.\\
\\
\\
\\
Read Blog](/content/blog/five-minutes-to-your-first-mcp-server-tool-a-quickstart-with-agentgateway/index.html)

\\
\\
\\
\\
**Agentic Quality Benchmarking With Agentevals** \\
\\
\\
\\
Read Blog](/content/blog/agentic-quality-benchmarking-with-agent-evals/index.html)

\\
\\
\\
\\
**The AppMesh Migration Playbook** \\
\\
\\
\\
Read Blog](/content/blog/the-app-mesh-migration-playbook/index.html)

\\
\\
\\
\\
**Solo Enterprise for Istio 1.29: ECS Now GA, Enhanced Debuggability, and Flexible Global Service Aliasing** \\
\\
The latest Solo Enterprise for Istio release delivers General Availability of AWS ECS integration and powerful new global service aliasing capabilities.\\
\\
\\
\\
Read Blog](/content/blog/solo-enterprise-for-istio-1-29/index.html)

\\
\\
\\
\\
**Your First AI Route: Connecting to OpenAI with AgentGateway** \\
\\
\\
\\
Read Blog](/content/blog/your-first-ai-route-connecting-to-openai-with-agentgateway/index.html)

\\
\\
\\
\\
**What Comes After Ingress NGINX? A Migration Guide to Gateway API** \\
\\
Ingress NGINX is being retired. This guide walks through migrating Ingress configs to Kubernetes Gateway API using ingress2gateway and kgateway.\\
\\
\\
\\
Read Blog](/content/blog/what-comes-after-ingress-nginx-a-migration-guide-to-gateway-api/index.html)

\\
\\
\\
\\
**Why Traditional Gateways Failed AI Workloads - and How Kgateway's Rust-powered Agentgateway Fixes It** \\
\\
Most AI gateways patch legacy proxies. Kgateway starts from first principles, rethinking the gateway for the agentic era with a data plane built specifically for modern AI traffic.\\
\\
\\
\\
Read Blog](/content/blog/why-traditional-gateways-failed-ai-workloads-and-how-kgateways-rust-powered-agentgateway-fixes-it/index.html)

\\
\\
\\
\\
**Context-aware Security for Agentic AI Gateways** \\
\\
If your gateway can’t tell the difference between a tool call and a model invocation, it can’t enforce meaningful security. Agentic systems demand a new class of context-aware, AI-native gateways.\\
\\
\\
\\
Read Blog](/content/blog/context-aware-security-ai-gateways/index.html)

\\
\\
\\
\\
**Kgateway: The Best Alternative for Ingress NGINX** \\
\\
Learn how kgateway, a CNCF-hosted project built on Envoy, offers a trusted path forward for Ingress NGINX.\\
\\
\\
\\
Read Blog](/content/blog/kgateway-the-best-alternative-for-ingress-nginx/index.html)

\\
\\
\\
\\
**The Linux Foundation’s new Agentic AI Foundation and Secure MCP Infrastructure** \\
\\
\\
\\
Read Blog](/content/blog/aaif-announcement-agentgateway/index.html)

\\
\\
\\
\\
**Security Holes in MCP Servers and How To Plug Them** \\
\\
Learn how to close the major security gaps in Model Context Protocol (MCP) with a proper AI Gateway. This guide walks you through deploying MCP Servers on Kubernetes, adding authentication, locking down tools, and strengthening your organization’s overall MCP security posture.\\
\\
\\
\\
Read Blog](/content/blog/security-holes-in-mcp-servers-and-how-to-plug-them/index.html)

\\
\\
\\
\\
**Announcing Gloo Mesh Support for Amazon ECS** \\
\\
Latest Gloo Mesh release now provides support and enterprise-grade service mesh capabilities for Amazon ECS workloads.\\
\\
\\
\\
Read Blog](/content/blog/announcing-gloo-mesh-support-for-amazon-ecs/index.html)

\\
\\
\\
\\
**Gloo Mesh 2.11: Expands Support to Amazon ECS and Brings Multi-Tenant Flexibility to Enterprises.** \\
\\
Latest Gloo Mesh release expands support to Amazon ECS and brings multi-tenant flexibility to enterprises.\\
\\
\\
\\
Read Blog](/content/blog/gloo-mesh-2-11-release/index.html)

\\
\\
\\
\\
**Reducing the costs and complexity of your cloud native architecture with Ambient Mesh** \\
\\
Learn how Istio's Ambient Mesh simplifies cloud-native connectivity and dramatically reduces the cost and complexity of connecting, securing, and observing services across on-prem, cloud, or hybrid environments — without sidecars.\\
\\
\\
\\
Read Blog](/content/blog/ambient-mesh-reducing-cost-complexity-cloud-native-architecture/index.html)

\\
\\
\\
\\
**Introducing Solo Enterprise for agentgateway** \\
\\
From pilots to production with context-aware AI networking\\
\\
\\
\\
Read Blog](/content/blog/introducing-solo-enterprise-for-agentgateway/index.html)

\\
\\
\\
\\
**Introducing Gloo Gateway 2.0** \\
\\
We're excited to introduce Gloo Gateway 2.0, built on the CNCF kgateway project and Kubernetes Gateway API. This release unifies open-source innovation with enterprise-grade extensions, ambient mesh integration, and AI-ready data planes to deliver secure, scalable, and future-proof API gateway capabilities for cloud-native and agentic workloads.\\
\\
\\
\\
Read Blog](/content/blog/introducing-gloo-gateway-2-0/index.html)

\\
\\
\\
\\
**Ambient mesh deployments made easy with Gloo Operator** \\
\\
This article discusses different ways to install Istio ambient mesh, and contrasts the Helm approach with the Gloo Operator, a new method for installing ambient mesh in Gloo Mesh.\\
\\
\\
\\
Read Blog](/content/blog/ambient-mesh-deployments-made-easy-with-gloo-operator/index.html)

\\
\\
\\
\\
**Choosing between installation methods in Gloo Mesh: Helm vs. the Gloo Operator** \\
\\
Explore Istio installation options with Gloo Mesh. Compare Helm for control and flexibility vs. Gloo Operator for simplicity and automation to find the best fit for your environment.\\
\\
\\
\\
Read Blog](/content/blog/gloo-mesh-installation-methods-helm-vs-gloo-operator/index.html)

\\
\\
\\
\\
**How ambient mesh challenges the security gaps in sidecar workloads** \\
\\
Discover how Istio’s ambient mesh strengthens microservices security beyond sidecars with improved isolation, reduced attack surfaces, and simpler operations.\\
\\
\\
\\
Read Blog](/content/blog/how-ambient-mesh-challenges-security-gaps-sidecar-workloads/index.html)

\\
\\
\\
\\
**Migrating from sidecars to ambient with zero downtime** \\
\\
Learn how to migrate from Istio sidecars to ambient mesh with zero downtime. Step-by-step strategies, best practices, and tools to ensure a safe transition.\\
\\
\\
\\
Read Blog](/content/blog/sidecars-ambient-zero-downtime/index.html)

\\
\\
\\
\\
**Comparing Istio's ambient multicluster support with Gloo Mesh's multicluster peering** \\
\\
Compare Istio’s new ambient multicluster support with Gloo Mesh’s multicluster peering. Learn the similarities, key differences, and scalability trade-offs.\\
\\
\\
\\
Read Blog](/content/blog/istio-ambient-multicluster-support-gloo-mesh-multicluster-peering/index.html)

\\
\\
\\
\\
**kgateway as Ingress for Ambient Service Mesh** \\
\\
Explore how kgateway and Istio Ambient Mesh work together to deliver secure ingress, intelligent routing and clear observability.\\
\\
\\
\\
Read Blog](/content/blog/kgateway-ingress-ambient-service-mesh/index.html)

\\
\\
\\
\\
**Tracing GenAI Applications Is Not Enough** \\
\\
\\
\\
Read Blog](/content/blog/tracing-genai-applications-is-not-enough/index.html)

\\
\\
\\
\\
**Gloo Mesh 2.10: More Secure, Scalable Cloud Connectivity** \\
\\
Gloo Mesh 2.10 adds flat network support, traffic shifting, and policy enforcement for secure, scalable multi-cluster service mesh.\\
\\
\\
\\
Read Blog](/content/blog/gloo-mesh-secure-scalable-cloud-connectivity/index.html)

\\
\\
\\
\\
**MCP Authorization is a Non-Starter for Enterprise**\\
\\
In this blog, we highlight some of MCP's foundational challenges, alternative proposals in the community, and sharing our opinion on what this should look like in enterprise environments. We know the MCP community is hard at work on revising the specification and we feel future updates will align better with our recommendations here. \\
\\
\\
\\
Read Blog](/content/blog/mcp-authorization-is-a-non-starter-for-enterprise/index.html)

\\
\\
\\
\\
**Securing and Observing Your Services, Simplified** \\
\\
Istio Ambient Mesh’s ztunnel delivers secure-by-default microservices communication and real-time traffic visibility - without sidecars. Learn how it boosts performance, simplifies management, and reduces costs while enhancing security and observability.\\
\\
\\
\\
Read Blog](/content/blog/securing-observing-services-simplified/index.html)

\\
\\
\\
\\
**From MCP Servers to Services: Introducing kmcp for Enterprise-Grade MCP Development** \\
\\
\\
\\
Read Blog](/content/blog/introducing-kmcp/index.html)

\\
\\
\\
\\
**The Power of a Single API to Secure, Observe, and Control Traffic in All Directions** \\
\\
Learn how the Omni vision unifies traffic, security, and observability control across cloud-native systems with Gloo Mesh and Gloo Gateway.\\
\\
\\
\\
Read Blog](/content/blog/api-secure-observe-control-traffic/index.html)

%20a%20Bad%20Idea.png)\\
\\
\\
\\
**Why Building Large Kubernetes Clusters Is (Still) a Bad Idea** \\
\\
Running massive Kubernetes clusters might seem simpler, but it’s a trap. Learn why scaling a single cluster creates hidden performance, security, and reliability issues, and how Gloo Mesh with Ambient Mesh makes multi-cluster networking finally viable.\\
\\
\\
\\
Read Blog](/content/blog/why-building-large-kubernetes-clusters-is-still-a-bad-idea/index.html)

\\
\\
\\
\\
**Fortifying Your Cloud Native Connectivity Security Posture with Solo and Ambient Mesh** \\
\\
Strengthen your cloud-native security posture with Istio and ambient mesh. Learn how ambient enhances zero-trust architecture, simplifies mTLS, reduces attack surface, and decouples security from app logic, all with less operational overhead.\\
\\
\\
\\
Read Blog](/content/blog/cloud-native-connectivity-security-solo-ambient-mesh/index.html)

\\
\\
\\
\\
**Migrating from Sidecars to Ambient Mesh - Risks, Challenges, and Benefits** \\
\\
Considering migrating from Istio sidecars to ambient mesh? Learn about the key challenges, risks, and benefits of ambient, including improved performance, lower costs, and operational simplicity, plus tips to plan a safe, successful transition.\\
\\
\\
\\
Read Blog](/content/blog/ambient-mesh-migration/index.html)

\\
\\
\\
\\
**Overhaul of Agent Gateway supporting A2A, MCP, and Kubernetes Gateway API** \\
\\
Today, we’re excited to share the next major milestone: Agent Gateway is now a full-featured, AI-native gateway that combines deep MCP and A2A protocol awareness, robust traffic policy controls, inference gateway support, Kubernetes Gateway API support, and unified access to major LLMs, all purpose-built with Rust for real-world agentic systems.\\
\\
\\
\\
Read Blog](/content/blog/updated-a2a-and-mcp-gateway/index.html)

\\
\\
\\
\\
**How Ambient Mesh Delivers Advanced Resource and Cost Savings** \\
\\
Discover how Ambient Mesh architecture can reduce service mesh infrastructure costs by up to 92% compared to traditional sidecar deployments, with real-world savings\\
\\
\\
\\
Read Blog](/content/blog/how-ambient-mesh-delivers-advanced-resource-and-cost-savings/index.html)

\\
\\
\\
\\
**Getting Started with Ambient Mesh: From 0 to 100 mph** \\
\\
Learn how Ambient Mesh revolutionizes service mesh architecture by eliminating sidecars and introducing a split proxy approach for better performance and operational simplicity.\\
\\
\\
\\
Read Blog](/content/blog/getting-started-with-ambient-mesh-from-0-to-100-mph/index.html)

\\
\\
\\
\\
**Agent Discovery, Naming, and Resolution - the Missing Pieces to A2A** \\
\\
While the A2A specification provides the critical first steps toward discovery with Agent Cards, the infrastructure for truly dynamic, scalable agent ecosystems requires additional components that the spec intentionally leaves “up to you.” In this blog, we dig into those missing pieces. \\
\\
\\
\\
Read Blog](/content/blog/agent-discovery-naming-and-resolution---the-missing-pieces-to-a2a/index.html)

\\
\\
\\
\\
**Part Two: MCP Authorization The Hard Way** \\
\\
Digging into the details of the MCP Authorization Spec\\
\\
\\
\\
Read Blog](/content/blog/part-two-mcp-authorization-the-hard-way/index.html)

\\
\\
\\
\\
**Part One: MCP Authorization The Hard Way** \\
\\
Deep dive into MCP Authorization, step by step with examples and in-depth detail\\
\\
\\
\\
Read Blog](/content/blog/understanding-mcp-authorization-step-by-step-part-one/index.html)

\\
\\
\\
\\
**Agent Identity and Access Management - Can SPIFFE Work?** \\
\\
Digging into AI identity and how the current SPIFFE models may need to be revised to support AI Agents\\
\\
\\
\\
Read Blog](/content/blog/agent-identity-and-access-management---can-spiffe-work/index.html)

\\
\\
\\
\\
**Deep Dive into llm-d and Distributed Inference** \\
\\
Digging into the llm-d project and how it does distributed inference.\\
\\
\\
\\
Read Blog](/content/blog/deep-dive-into-llm-d-and-distributed-inference/index.html)

\\
\\
\\
\\
**Gloo Mesh 2.8 simplifies service mesh operations with new enhanced user experience across multi-cluster environments.** \\
\\
\\
\\
Read Blog](/content/blog/gloo-mesh-2-8-release/index.html)

\\
\\
\\
\\
**Gloo Gateway 1.19 accelerates context-rich, real-time AI apps with Gateway API** \\
\\
\\
\\
Read Blog](/content/blog/gloo-gateway-1-19-release/index.html)

\\
\\
\\
\\
**llm-d: Distributed Inference Serving on Kubernetes** \\
\\
\\
\\
Read Blog](/content/blog/llm-d-distributed-inference-serving-on-kubernetes/index.html)

\\
\\
**Motive** \\
\\
Motive modernized its infrastructure using Solo Enterprise for kgateway to boost reliability, developer agility, and fleet innovation.\\
\\
\\
\\
Read Case Study](/content/resources/case-study/motive/index.html)

\\
\\
**Confluent** \\
\\
Discover how Confluent achieved 100% mTLS coverage, FedRAMP-ready FIPS encryption, and real-time observability across 100+ services using Solo Enterprise for Istio.\\
\\
\\
\\
Read Case Study](/content/resources/case-study/confluent/index.html)

\\
\\
**Ingenico** \\
\\
Powered by Solo Enterprise for kgateway, Solo.io helped Ingenico modernize its global payments infrastructure—boosting scalability, resilience, and developer autonomy. Explore their journey to building a fault-tolerant, future-ready platform.\\
\\
\\
\\
Read Case Study](/content/resources/case-study/ingenico-2/index.html)

\\
\\
**OfferUp** \\
\\
OfferUp leveraged Kubernetes and Solo Enterprise for kgateway to modernize its marketplace, enabling developer self-service, faster deployments, and seamless scaling beyond peer-to-peer transactions.\\
\\
\\
\\
Read Case Study](/content/resources/case-study/offerup/index.html)

\\
\\
**ParkMobile** \\
\\
ParkMobile’s Platform Engineering team utilized Kubernetes and Solo Enterprise for kgateway to drive innovation, scalability, and seamless mobility solutions while fostering a culture of collaboration and technological excellence.\\
\\
\\
\\
Read Case Study](/content/resources/case-study/park-mobile/index.html)

\\
\\
**Vonage** \\
\\
Solo.io helped Vonage modernize its cloud infrastructure, enhancing scalability, reliability, and developer autonomy with Solo Enterprise for kgateway. Explore their journey to a building an efficient and agile platform.\\
\\
\\
\\
Read Case Study](/content/resources/case-study/vonage-2/index.html)

\\
\\
**Domino’s Pizza** \\
\\
Powered by Solo Enterprise for Istio and Solo Enterprise for kgateway, Solo.io helped Domino’s UK transition from a monolithic system to a microservices-based architecture. Learn about our 18-month journey to transform the way they operate.\\
\\
\\
\\
Read Case Study](/content/resources/case-study/dominos-pizza-uk/index.html)

\\
\\
**Introducing Solo Enterprise for agentgateway** \\
\\
Secure, govern, and operationalize AI agent connectivity at scale with Solo Enterprise for agentgateway\\
\\
\\
\\
Read Datasheet](/content/resources/datasheet/introducing-solo-enterprise-for-agentgateway/index.html)

\\
\\
**Comparing Sidecars with Sidecarless Mesh Implementation** \\
\\
Compare sidecar-based Istio with sidecarless Ambient Mesh. Learn how Gloo Mesh simplifies service mesh operations, reduces overhead, and enables scalable, secure, multi-cluster environments — with support for both migration paths.\\
\\
\\
\\
Read Datasheet](/content/resources/datasheet/comparing-sidecars-with-sidecarless-mesh-implementation/index.html)

\\
\\
**Solo Enterprise for Istio Feature Comparison** \\
\\
Compare features across Gloo Mesh Enterprise, Gloo Mesh Open Source, and Basic Open Source Istio.\\
\\
\\
\\
Read Datasheet](/content/resources/datasheet/gloo-mesh-feature-comparison/index.html)

\\
\\
**Enterprise Support for Istio in Production** \\
\\
Solo.io provides enterprise support for Istio environments to help you avoid pitfalls and resolve issues quickly.\\
\\
\\
\\
Read Datasheet](/content/resources/datasheet/enterprise-support-for-istio-in-production/index.html)

\\
\\
**Service Mesh for Developers, Part 1: Exploring the Power of Observability and OpenTelemetry** \\
\\
Navigating the complexity of modern applications requires a key ally – observability. Observability empowers teams to streamline application debugging, and within the architecture of a service mesh, provides valuable insights that increase reliability and performance.\\
\\
\\
\\
Read Ebook](/content/resources/ebook/service-mesh-for-developers-part-1/index.html)

\\
\\
**Service Mesh at Scale** \\
\\
Challenges and approaches to multi-cluster deployment patterns\\
\\
\\
\\
Read Ebook](/content/resources/ebook/service-mesh-at-scale/index.html)

\\
\\
**Compare Capabilities of the Top Service Mesh Platforms** \\
\\
Using a service mesh as a layer to unify communications between applications, services, and workloads empowers teams to modernize their systems, deliver faster results, and improve performance for modern enterprises.\\
\\
\\
\\
Read Ebook](/content/resources/ebook/buyers-guide-service-mesh/index.html)

\\
\\
**Compare Capabilities of the Top API Gateways** \\
\\
Download our Buyer’s Guide to API Gateways and learn about the modern requirements of API gateways in our guide’s comparison of five leading API gateway providers.\\
\\
\\
\\
Read Ebook](/content/resources/ebook/api-gateway-buyers-guide/index.html)

\\
\\
**Establishing zero trust security for modern cloud architectures** \\
\\
How your organization can ensure safer cloud architecture by applying a zero trust network security model\\
\\
\\
\\
Read Ebook](/content/resources/ebook/establishing-zero-trust-security-for-modern-cloud-architectures/index.html)

\\
\\
**Unlocking the Power of Your API Gateway** \\
\\
With automated API management, organizations save time and resources and streamline the development process.\\
\\
\\
\\
Read Ebook](/content/resources/ebook/unlocking-the-power-of-your-api-gateway/index.html)

\\
\\
**API Gateways: Productivity, Resilience, and Security for Next-Generation Cloud Applications** \\
\\
The rise of microservices architecture has brought about a significant shift in how software is developed and deployed, and as such, has presented new technical and organizational challenges.\\
\\
\\
\\
Read Ebook](/content/resources/ebook/api-gateways-productivity-resilience-and-security-for-next-generation-cloud-applications/index.html)

\\
\\
**Driving Business Value with Istio** \\
\\
How a service mesh can help your organization simplify the adoption of a distributed architecture\\
\\
\\
\\
Read Ebook](/content/resources/ebook/driving-business-value-with-istio/index.html)

\\
\\
**Service Mesh Vendor Comparison** \\
\\
See how top vendors with Istio-based service mesh offerings compare\\
\\
\\
\\
Read Ebook](/content/resources/ebook/istio-service-mesh-vendor-comparison/index.html)

\\
\\
**Istio Then & Now** \\
\\
\\
\\
Read Infographic](/content/resources/infographic/istio-then-now/index.html)

\\
\\
**4 Reasons Why You Need an AI Gateway** \\
\\
Integrating LLM models in your applications? See our infographic to learn the top four reasons why you need an AI Gateway!\\
\\
\\
\\
Read Infographic](/content/resources/infographic/4-reasons-why-you-need-an-ai-gateway/index.html)

\\
\\
**Solo Enterprise for kgateway vs. Kong** \\
\\
Kong Gateway offers a very capable competitor to Gloo Gateway by Solo.io, but there are growing questions about the efficacy and stability of the Nginx open-source community behind the technology.\\
\\
\\
\\
Read Infographic](/content/resources/infographic/gloo-gateway-vs-kong/index.html)

\\
\\
**Solo Enterprise for kgateway vs. Apigee** \\
\\
Apigee suits Google Cloud, but its traditional approach clashes with modern practices. In contrast, Gloo Gateway by Solo.io aligns with cloud-native strategies.\\
\\
\\
\\
Read Infographic](/content/resources/infographic/gloo-gateway-vs-apigee/index.html)

\\
\\
**3 Reasons You Need an API Gateway for Microservices Apps** \\
\\
Unlock the full potential of your microservices architecture with the strategic integration of API gateways. While microservices provide flexibility and scalability, they also introduce complexities that can impede seamless communication between services. Discover the crucial role of API gateways in overcoming these challenges and optimizing your microservices ecosystem.\\
\\
\\
\\
Read Infographic](/content/resources/infographic/3-reasons-you-need-an-api-gateway-for-microservices-apps/index.html)

\\
\\
**Migrate to agentgateway with the ingress2gateway tool** \\
\\
Learn to migrate your ingress-nginx Ingress configurations to agentgateway with the ingress2gateway tool. \\
\\
\\
\\
Read Lab](/content/resources/lab/migrate-to-agentgateway-with-the-ingress2gateway-tool/index.html)

\\
\\
**Migrate to kgateway with the ingress2gateway tool** \\
\\
Learn to migrate your ingress-nginx Ingress configurations to kgateway with the ingress2gateway tool.\\
\\
\\
\\
Read Lab](/content/resources/lab/migrate-to-kgateway-with-the-ingress2gateway-tool/index.html)

\\
\\
**Introduction to agentregistry** \\
\\
Free Lab: Learn how to curate, publish, and deploy MCP servers and AI skills using agentregistry for unified management of AI-native artifacts.\\
\\
\\
\\
Read Lab](/content/resources/lab/introduction-to-agentregistry/index.html)

\\
\\
**Build AI agents with agent skills** \\
\\
Free Lab: Learn to build a declarative AI agent in kagent with a Kubernetes deployment skill, enabling automated app deployments and MCP tool integration.\\
\\
\\
\\
Read Lab](/content/resources/lab/build-ai-agents-with-agent-skills/index.html)

\\
\\
**Program agentgateway for LLM consumption** \\
\\
Free Lab: Learn to proxy OpenAI requests through an agentgateway-backed AI gateway with kgateway, managing LLM traffic, credentials, and advanced features.\\
\\
\\
\\
Read Lab](/content/resources/lab/program-agentgateway-for-llm-consumption/index.html)

\\
\\
**Local development with the kagent CLI** \\
\\
Free Lab: Learn to build, run, and deploy AI agents with kagent, integrate MCP servers, and manage tools in Kubernetes for AI-native workloads.\\
\\
\\
\\
Read Lab](/content/resources/lab/local-development-with-the-kagent-cli/index.html)

\\
\\
**Secure your MCP servers with OAuth** \\
\\
Free Lab: Learn to build, proxy, and secure an MCP server with agentgateway and OAuth2, protecting AI-native workloads while enabling safe tool access in Kubernetes.\\
\\
\\
\\
Read Lab](/content/resources/lab/secure-your-mcp-servers-with-oauth/index.html)

\\
\\
**Improve cloud native operations & troubleshooting with kagent** \\
\\
Free Lab: Use AI agents with kgateway and kagent to automate Kubernetes tasks, provision gateways, route traffic, and manage workloads in a cloud-native environment.\\
\\
\\
\\
Read Lab](/content/resources/lab/improve-cloud-native-ops-troubleshooting/index.html)

\\
\\
**Observe Agent & MCP server interactions** \\
\\
Free Lab: Learn how to use Solo Enterprise for kagent to create, run, and monitor AI agents in Kubernetes with full observability and control.\\
\\
\\
\\
Read Lab](/content/resources/lab/observe-agent-mcp-server-interactions/index.html)

\\
\\
**Multiplex MCP servers & control auth policy** \\
\\
Solo Free Lab: Learn how to use kgateway and agentgateway to deploy, proxy, and secure MCP servers in Kubernetes with AI-native control and traffic routing.\\
\\
\\
\\
Read Lab](/content/resources/lab/multiplex-mcp-servers-control-auth-policy/index.html)

\\
\\
**Build, run & deploy MCP servers to Kubernetes** \\
\\
Solo Free Lab: Learn to use the new kmcp tool to easily deploy MCP servers to Kubernetes.\\
\\
\\
\\
Read Lab](/content/resources/lab/build-run-deploy-mcp-servers-to-kubernetes/index.html)

\\
\\
**Kagent Lab: Discover kagent and kmcp** \\
\\
Explore the kagent project to build custom agents and tools\\
\\
\\
\\
Read Lab](/content/resources/lab/kagent-lab-discover-kagent-kmcp/index.html)

\\
\\
**Solo Enterprise for Istio Lab: OpenTelemetry collectors and relay** \\
\\
Solo.io Free Lab: Learn about the relay of telemetry from a workload cluster to the management cluster in Gloo Mesh.\\
\\
\\
\\
Read Lab](/content/resources/lab/gloo-mesh-otel-collectors-relay/index.html)

\\
\\
**Solo Enterprise for Istio Lab: Extended telemetry from ztunnel** \\
\\
Solo.io Free Lab: Learn how to deploy Istio Ambient Mesh with Gloo Mesh to capture Layer 7 telemetry directly from zTunnel - no waypoints required.\\
\\
\\
\\
Read Lab](/content/resources/lab/gloo-mesh-extended-telemetry-ztunnel/index.html)

\\
\\
**Solo Enterprise for Istio Lab: Configure enhanced waypoint proxies** \\
\\
Solo.io Free Lab: Learn how to use Gloo Gateway for your waypoints in Gloo Mesh, instead of Istio's default waypoint proxy.\\
\\
\\
\\
Read Lab](/content/resources/lab/gloo-mesh-lab-enhanced-waypoint-proxies/index.html)

\\
\\
**Solo Enterprise for Istio Lab: Multicluster peering** \\
\\
Solo.io Free Lab: Learn how to enable multicluster peering in Gloo Mesh to run services across clusters as a single mesh, making workloads visible and accessible between clusters with global failover and redundancy.\\
\\
\\
\\
Read Lab](/content/resources/lab/gloo-mesh-lab-multicluster-peering/index.html)

\\
\\
**Ambient Mesh Lab: EnvoyFilter Support** \\
\\
Solo.io Free Lab: Learn how to preserve and migrate EnvoyFilter configurations when transitioning from sidecar to ambient mode in Istio using Solo.io’s extended build, with step-by-step guidance and validation.\\
\\
\\
\\
Read Lab](/content/resources/lab/ambient-mesh-lab-envoyfilter-support/index.html)

\\
\\
**Ambient Mesh Lab: SPIRE integration with Gloo Mesh in Istio Ambient Mode** \\
\\
Secure your Istio Ambient Mesh with SPIRE. This hands-on lab shows how to integrate SPIRE with Gloo Mesh to issue SPIFFE identities and certificates for ztunnel and mesh workloads.\\
\\
\\
\\
Read Lab](/content/resources/lab/gloo-mesh-lab-spire-integration-with-gloo-mesh-in-ambient-mode/index.html)

\\
\\
**Ambient Mesh Lab: Introduction to ztunnel in Ambient Mesh** \\
\\
Learn how Ambient Mesh uses ztunnel to secure traffic without sidecars. This free lab walks you through joining workloads, observing traffic, verifying mTLS, and applying Layer 4 policies.\\
\\
\\
\\
Read Lab](/content/resources/lab/gloo-mesh-lab-intro-ztunnel-ambient-mesh/index.html)

\\
\\
**Solo Academy Course: Service Mesh Basics** \\
\\
Solo Academy \| Learn the fundamentals of service mesh in this free video-led course and get insights into using a service mesh to enhance your observability, security and reliability of your applications \\
\\
\\
\\
Read Lab](/content/resources/lab/solo-academy-course-service-mesh-basics/index.html)

\\
\\
**Solo Academy Course: Istio Basics** \\
\\
Solo Academy \| Learn the basics of Istio with our free 101 course. Understand what Istio is, how it works, and its features for traffic management, security, and observability in microservices and Kubernetes.\\
\\
\\
\\
Read Lab](/content/resources/lab/solo-academy-course-istio-basics/index.html)

\\
\\
**Solo Academy Course: Envoy Basics** \\
\\
Solo Academy \| Master Envoy Proxy basics with our free 101 level course. Learn about the architecture, advanced load balancing, observability, and role in microservices, Kubernetes, and service meshes\\
\\
\\
\\
Read Lab](/content/resources/lab/solo-academy-course-envoy-basics/index.html)

\\
\\
**Solo Academy Course: API Gateway Basics** \\
\\
Solo Academy \| Learn API Gateway fundamentals in Kubernetes with this free beginner level video-led course. Discover how API Gateways control traffic, secure connectivity, and complement microservices architecture\\
\\
\\
\\
Read Lab](/content/resources/lab/solo-academy-course-api-gateway-basics/index.html)

\\
\\
**Solo Academy Course: Get Started with Istio Service Mesh** \\
\\
Solo Academy \| A fundamental level workshop for developers and operators to learn Istio service mesh. Install Istio, secure services, control traffic, and earn a Solo.io certification through hands-on labs.\\
\\
\\
\\
Read Lab](/content/resources/lab/solo-academy-course-get-started-with-istio-service-mesh/index.html)

\\
\\
**Solo Academy Course: Introduction to Envoy Proxy** \\
\\
Solo Academy \| Hands-on workshop introducing the core concepts of Envoy Proxy. Learn how Envoy works under the hood from its architecture, filter chains, and request flow and beyond the abstractions of service meshes and API gateways.\\
\\
\\
\\
Read Lab](/content/resources/lab/solo-academy-course-introduction-to-envoy-proxy/index.html)

\\
\\
**Solo Academy Course: Deploying Istio for Production** \\
\\
Solo Academy \| Free hands-on workshop for operators looking to deploy Istio in production. Learn advanced routing, observability, security, mTLS, and multi-cluster setup and g free certification. \\
\\
\\
\\
Read Lab](/content/resources/lab/solo-academy-course-deploying-istio-for-production/index.html)

\\
\\
**Kgateway Lab: Integrating kgateway with Istio at Ingress** \\
\\
Explore how to integrate kgateway's ingress gateway with Istio Ambient Mesh in this free hands-on lab. Learn to deploy workloads, configure Gateway and Route resources, and enable automatic mutual TLS between the gateway and backend services.\\
\\
\\
\\
Read Lab](/content/resources/lab/kgateway-lab-integrating-kgateway-with-istio-at-ingress/index.html)

\\
\\
**Kgateway Lab: Kgateway as a Waypoint** \\
\\
Learn how to deploy and configure kgateway as a waypoint in Istio Ambient Mesh. This free hands-on lab walks you through managing east-west traffic, applying custom policies, and enhancing service communication with enterprise-grade control.\\
\\
\\
\\
Read Lab](/content/resources/lab/kgateway-lab-kgateway-as-a-waypoint/index.html)

\\
\\
**Kgateway AI Lab: Deploying kgateway as an AI Gateway** \\
\\
Learn how to enable the AI extension, configure gateway parameters, and deploy an AI Gateway using kgateway to route requests to large language models (LLMs) from within your Kubernetes cluster.\\
\\
\\
\\
Read Lab](/content/resources/lab/deploying-kgateway-as-an-ai-gateway/index.html)

\\
\\
**Kagent Lab: How to build an AI agent** \\
\\
Create Your First AI Agent with Kagent in Kubernetes\\
\\
\\
\\
Read Lab](/content/resources/lab/kagent-lab-how-to-build-an-ai-agent/index.html)

\\
\\
**Kagent Lab: Integrate tools from MCP servers with kagent** \\
\\
Kagent Lab: Integrate tools from MCP servers with kagent\\
\\
\\
\\
Read Lab](/content/resources/lab/kagent-lab-integrate-tools-from-mcp-servers-with-kagent/index.html)

\\
\\
**agentgateway Hands-On Lab: Semantic Caching** \\
\\
agentgateway Labs \| Semantic Caching with Gloo AI Gateway \\
\\
\\
\\
Read Lab](/content/resources/lab/gloo-ai-gateway-hands-on-lab-semantic-caching/index.html)

\\
\\
**Kgateway AI Lab: Credentials Management** \\
\\
kgateway labs \| Managing LLM Credentials with kgateway - AI Gateway\\
\\
\\
\\
Read Lab](/content/resources/lab/kgateway-ai-lab-credentials-management/index.html)

\\
\\
**Kgateway AI Lab: Prompt Enrichment** \\
\\
Kgateway labs \| Managing Prompts for Enhanced LLM Performance\\
\\
\\
\\
Read Lab](/content/resources/lab/kgateway-ai-lab-prompt-enrichment/index.html)

\\
\\
**Kgateway AI Lab: Prompt Guards** \\
\\
kgateway labs \| Content Safety with Prompt Guards \\
\\
\\
\\
Read Lab](/content/resources/lab/kgateway-ai-lab-prompt-guards/index.html)

\\
\\
**Ambient Mesh Lab: Migrating from Sidecar to Sidecarless** \\
\\
Ambient Mesh Lab \| Migrate from Sidecar-based Service Mesh to Ambient Mesh \\
\\
\\
\\
Read Lab](/content/resources/lab/ambient-mesh-lab-migrating-from-sidecar-to-sidecarless/index.html)

\\
\\
**Ambient Mesh Lab: Multi-cluster scalability with Istio Ambient Mesh** \\
\\
Mastering Multi-Cluster Scalability with Ambient Mesh\\
\\
\\
\\
Read Lab](/content/resources/lab/ambient-mesh-lab-multi-cluster-scalability-with-istio-ambient-mesh/index.html)

\\
\\
**Solo Lab: Gloo Cloud Preview** \\
\\
Simplify Mesh Management with Gloo Cloud: Onboarding, Ingress, Egress, and Service Mesh\\
\\
\\
\\
Read Lab](/content/resources/lab/solo-lab-gloo-cloud-preview/index.html)

\\
\\
**Ambient Mesh Lab: Waypoints for Traffic management, Security and Observability** \\
\\
Solo Lab \| Waypoints in Ambient Mesh: For L4 and L7 Security, Traffic and Observability Insights\\
\\
\\
\\
Read Lab](/content/resources/lab/ambient-mesh-lab-waypoints-for-traffic-management-security-and-observability/index.html)

\\
\\
**Kgateway Lab: Gateway API inference extensions with kgateway** \\
\\
Exploring the Gateway API Inference Extension with kgateway\\
\\
\\
\\
Read Lab](/content/resources/lab/kgateway-lab-gateway-api-inference-extensions-with-kgateway/index.html)

\\
\\
**Kgateway Lab: Securing access to workloads with Gloo Gateway** \\
\\
Securing Services with Gloo Gateway: TLS Termination and API Keys\\
\\
\\
\\
Read Lab](/content/resources/lab/gloo-gateway-lab-securing-access-to-workloads-with-gloo-gateway/index.html)

\\
\\
**Kgateway Lab: Route Delegation in kgateway** \\
\\
Route Delegation in kgateway\\
\\
\\
\\
Read Lab](/content/resources/lab/route-delegation-in-kgateway/index.html)

\\
\\
**Kgateway Lab: Canary releases with Argo Rollouts & kgateway** \\
\\
Canary releases with Argo Rollouts & kgateway\\
\\
\\
\\
Read Lab](/content/resources/lab/canary-releases-with-argo-rollouts-kgateway/index.html)

\\
\\
**Kgateway Lab: Understanding kgateway and Gateway API policy attachments** \\
\\
Understanding kgateway patterns of extensions \\
\\
\\
\\
Read Lab](/content/resources/lab/understanding-kgateway-patterns-of-extensions/index.html)

\\
\\
**Kgateway Lab: Gateway API support for service mesh with kgateway** \\
\\
GatewayAPI support for service mesh with kgateway\\
\\
\\
\\
Read Lab](/content/resources/lab/gatewayapi-support-for-service-mesh-with-kgateway/index.html)

\\
\\
**Kgateway Lab: Exploring HTTPRoute resource configurations with kgateway** \\
\\
Exploring HTTPRoute resource configurations with kgateway\\
\\
\\
\\
Read Lab](/content/resources/lab/exploring-httproute-resource-configurations-with-kgateway/index.html)

\\
\\
**Kgateway Lab: Configuring gateways across multiple teams with kgateway**\\
\\
Configuring gateways across multiple teams with kgateway\\
\\
\\
\\
Read Lab](/content/resources/lab/configuring-gateways-across-multiple-teams-with-kgateway/index.html)

\\
\\
**Kgateway Lab: Configure HTTPS with the Gateway API and kgateway** \\
\\
Configure HTTPS with the Gateway API and kgateway\\
\\
\\
\\
Read Lab](/content/resources/lab/configure-https-with-the-gateway-api-and-kgateway/index.html)

\\
\\
**Kgateway Lab: Understanding the basics of Kubernetes Gateway API with kgateway** \\
\\
Understanding the basics of Kubernetes Gateway API with kgateway\\
\\
\\
\\
Read Lab](/content/resources/lab/understanding-the-basics-of-kubernetes-gateway-api-with-kgateway/index.html)

\\
\\
**Kgateway Lab: Installing kgateway, an open-source implementation of the Kubernetes Gateway API** \\
\\
Installing kgateway, an open-source implementation of the Kubernetes Gateway API\\
\\
\\
\\
Read Lab](/content/resources/lab/install-kgateway-open-source-implementation-of-the-gateway-api/index.html)

\\
\\
**Ambient Mesh Lab: Employing circuit breaking in Ambient Mesh** \\
\\
Join our free, on-demand lab Employing Circuit Breaking to safeguard services with Istio Ambient mode. Learn to deploy waypoints, configure circuit breaking, and monitor using metrics, logs, and Prometheus.\\
\\
\\
\\
Read Lab](/content/resources/lab/employing-circuit-breaking-in-ambient-mesh/index.html)

\\
\\
**Ambient Mesh Lab: Configuring Fault Injection in Ambient Mesh** \\
\\
Join our free, on-demand lab Configuring Fault Injection to enhance resiliency with Istio Ambient mode. Learn to observe system latency, configure delays, timeouts, retries, and augment with outlier detection.\\
\\
\\
\\
Read Lab](/content/resources/lab/configuring-fault-injection-in-ambient-mesh/index.html)

\\
\\
**Ambient Mesh Lab: Using Outlier Detection with Ambient Mesh** \\
\\
Join our free, on-demand lab Using Outlier Detection to learn how to configure Istio Ambient mode to avoid unhealthy workloads. Discover steps to implement outlier detection, assess workload health, and monitor metrics effectively.\\
\\
\\
\\
Read Lab](/content/resources/lab/using-outlier-detection-with-ambient-mesh/index.html)

\\
\\
**Ambient Mesh Lab: Implementing Timeouts with Ambient Mesh** \\
\\
Join our free on-demand lab, Implementing Timeouts, and learn how to protect applications from slow upstream services with Istio. Discover how to prevent indefinite errors, configure and verify timeouts, and decouple resiliency concerns from your apps.\\
\\
\\
\\
Read Lab](/content/resources/lab/implementing-timeouts/index.html)

\\
\\
**Ambient Mesh Lab: Traffic routing with waypoints in Ambient Mesh** \\
\\
Learn how to route traffic using waypoint proxies in ambient mesh.\\
\\
\\
\\
Read Lab](/content/resources/lab/traffic-routing-with-waypoints/index.html)

\\
\\
**Ambient Mesh Lab: Secure Your Cluster with Ambient Mesh and mTLS** \\
\\
Learn how to secure services in your Kubernetes cluster using ambient mesh and mTLS.\\
\\
\\
\\
Read Lab](/content/resources/lab/secure-your-cluster-with-ambient-mesh-and-mtls/index.html)

\\
\\
**Ambient Mesh Lab: Access control with authorization policies** \\
\\
Learn how to enforce access control and write authorization policies for L4 and L7 traffic.\\
\\
\\
\\
Read Lab](/content/resources/lab/access-control-with-authorization-policies/index.html)

\\
\\
**Ambient Mesh Lab: Getting Started with Ambient Mesh** \\
\\
Learn the basics of ambient and how to set up your first environment.\\
\\
\\
\\
Read Lab](/content/resources/lab/getting-started-with-ambient-mesh/index.html)

\\
\\
**Ambient Mesh Lab: Getting L4 and L7 observability** \\
\\
Learn how to view metrics and traces from L4 and L7 traffic in ambient mesh.\\
\\
\\
\\
Read Lab](/content/resources/lab/getting-l4-and-l7-observability/index.html)

\\
\\
**agentgateway Hands-On Lab: Prompt Management and Prompt Guards** \\
\\
Sign up for the free, hands-on technical labs.\\
\\
\\
\\
Read Lab](/content/resources/lab/gloo-ai-gateway-hands-prompt-management-prompt-guards/index.html)

\\
\\
**agentgateway Hands-On Lab: Rate Limiting and Model Failover** \\
\\
Sign up for the free, hands-on technical labs.\\
\\
\\
\\
Read Lab](/content/resources/lab/gloo-ai-gateway-rate-limiting-model-failover/index.html)

\\
\\
**agentgateway Hands-On Lab: RAG and Semantic Caching** \\
\\
Sign up for the free, hands-on technical labs.\\
\\
\\
\\
Read Lab](/content/resources/lab/gloo-ai-gateway-rag-semantic-caching/index.html)

\\
\\
**agentgateway Hands-On Lab: Credentials and Access Control** \\
\\
Sign up for the free, hands-on technical labs.\\
\\
\\
\\
Read Lab](/content/resources/lab/gloo-ai-gateway-credentials-access-control/index.html)

\\
\\
**AI Agents in Kubernetes** \\
\\
\\
\\
Read Report](/content/resources/report/ai-agents-in-kubernetes/index.html)

\\
\\
**Gartner® Report: How to Adapt Your API Strategy to Succeed in the AI Era** \\
\\
As organizations unlock the potential of generative AI, one thing is clear: a modern, scalable API strategy is essential. In this complimentary Gartner® report learn how software engineering leaders can evolve their API programs to accelerate innovation, reduce risk, and control costs in the AI era.\\
\\
\\
\\
Read Report](/content/resources/report/gartner-report-how-to-adapt-your-api-strategy-to-succeed-in-the-ai-era/index.html)

\\
\\
**AI Gateways in the Enterprise** \\
\\
\\
\\
Read Report](/content/resources/report/ai-gateways-in-the-enterprise/index.html)

\\
\\
**API Gateway Resource Kit** \\
\\
A service mesh is a dedicated infrastructure layer that helps manage and secure communications between microservices within a distributed application.\\
\\
\\
\\
Read Blog](/content/resources/resource-kit/api-gateway/index.html)

\\
\\
**Service Mesh Resource Kit** \\
\\
A service mesh is a dedicated infrastructure layer that helps manage and secure communications between microservices within a distributed application.\\
\\
\\
\\
Read Blog](/content/resources/resource-kit/service-mesh/index.html)

\\
\\
**AI Agents Are Not APIs. Existing Gateways Can't Tell the Difference.** \\
\\
\\
\\
Read Whitepaper](/content/resources/white-paper/ai-agents-are-not-apis/index.html)

\\
\\
**Building Responsive and Resilient Multi-Cluster Applications with Solo’s Ambient Mesh** \\
\\
\\
\\
Read Whitepaper](/content/resources/white-paper/building-responsive-and-resilient-multi-cluster-applications-with-solos-ambient-mesh/index.html)

\\
\\
**Busting 10 Myths About Istio Ambient and Sidecarless Service Mesh** \\
\\
\\
\\
Read Whitepaper](/content/resources/white-paper/busting-10-myths-about-istio-ambient/index.html)

\\
\\
**Guide to Migrating from Ingress to Gateway API** \\
\\
Migrate your project from ingress-nginx and the Ingress API to the Kubernetes Gateway API with kgateway—an open-source Gateway project powered by Envoy.\\
\\
\\
\\
Read Whitepaper](/content/resources/white-paper/guide-to-migrating-from-ingress-to-gateway-api/index.html)

\\
\\
**Migrating from Sidecars to Sidecarless Istio Ambient Mesh** \\
\\
In our white paper Migrating from Sidecars to Sidecarless to Ambient Mesh, we share how sidecars and Ambient mode can work together, allowing for a gradual migration strategy.\\
\\
\\
\\
Read Whitepaper](/content/resources/white-paper/migrating-from-sidecars-to-sidecarless-istio-ambient-mesh/index.html)

\\
\\
**Introduction and Best Practices to AI Gateways** \\
\\
\\
\\
Read Whitepaper](/content/resources/white-paper/intro-best-practices-to-ai-gateways/index.html)

\\
\\
**Choosing the Right AI Gateway For You** \\
\\
Read our white paper and learn how to select the right AI Gateway to help you navigate the challenges of working with AI workloads. \\
\\
\\
\\
Read Whitepaper](/content/resources/white-paper/choosing-the-right-ai-gateway-for-you/index.html)

\\
\\
**Solo.io’s Guide to Navigating GenAI Complexity** \\
\\
\\
\\
Read Whitepaper](/content/resources/white-paper/guide-to-navigating-genai-complexity/index.html)

\\
\\
**Unlocking Business Efficiency with Service Mesh Updates in AWS** \\
\\
\\
\\
Read Whitepaper](/content/resources/white-paper/service-mesh-aws/index.html)

\\
\\
**Evolve Your API Management** \\
\\
\\
\\
Read Whitepaper](/content/resources/white-paper/evolve-your-api-management/index.html)

\\
\\
**Transitioning From App Mesh to Istio for AWS EKS** \\
\\
\\
\\
Read Whitepaper](/content/resources/white-paper/app-mesh-istio-aws-eks-transition/index.html)

\\
\\
**How Service Mesh Supports a Zero Trust Architecture** \\
\\
\\
\\
Read Whitepaper](/content/resources/white-paper/how-service-mesh-supports-a-zero-trust-architecture/index.html)

\\
\\
**Achieve Compliance, Zero Trust with Istio Ambient Mode** \\
\\
\\
\\
Read Whitepaper](/content/resources/white-paper/achieve-compliance-zero-trust-with-istio-ambient-mesh/index.html)

\\
\\
**Get started** \\
\\
See why Solo.io is the leading provider of API Gateway and service mesh solutions.\\
\\
\\
\\
Learn more](/content/get-started/index.html)

\\
\\
**Istio support** \\
\\
Is Istio not working properly for you? Are you having performance issues with your Istio instance? Is there an upgrade you need to manage on multiple clusters?\\
\\
\\
\\
Get support](/content/istio-support/index.html)

\\
\\
**Pricing** \\
\\
Reach out for tailored pricing options and step into a future of enhanced connectivity.\\
\\
\\
\\
Get Started](/content/pricing/index.html)

\\
\\
**Book a Gloo AI Gateway demo** \\
\\
Powered by Istio, Gloo Mesh empowers platform engineering teams to boost security, resiliency, and observability.\\
\\
\\
\\
Get started](/content/products/gloo-ai-gateway/demo/index.html)

\\
\\
**Book a Gloo Gateway demo** \\
\\
Gloo Gateway is a fast, Kubernetes-
native API gateway packed with features IT operations teams need to deliver a full lifecycle security strategy for their cloud-native environments.\\
\\
\\
\\
Get started](/content/products/gloo-gateway/demo/index.html)

\\
\\
**Gloo Mesh - Ambient Readiness Assessment** \\
\\
A free program designed to assess your readiness for Istio Ambient adoption and prove the business benefits based on your own environment.\\
\\
\\
\\
Get started](/content/products/gloo-mesh/ambient-readiness-assessment/index.html)

\\
\\
**Book a Gloo Mesh demo** \\
\\
A free program designed to assess your readiness for Istio Ambient adoption and prove the business benefits based on your own environment.\\
\\
\\
\\
Get started](/content/products/gloo-mesh/demo/index.html)

\\
\\
**Case Studies** \\
\\
\\
\\
Learn more](/content/resources/case-study/index.html)

\\
\\
**Ebooks** \\
\\
\\
\\
Learn more](/content/resources/ebook/index.html)

\\
\\
**Labs** \\
\\
\\
\\
Learn more](/content/resources/lab/index.html)

\\
\\
**Reports** \\
\\
\\
\\
Read Reports](/content/resources/report/index.html)

\\
\\
**Resource Kits** \\
\\
\\
\\
See Resource Kits](/content/resources/resource-kit/index.html)

\\
\\
**Webinars** \\
\\
A free program designed to assess your readiness for Istio Ambient adoption and prove the business benefits based on your own environment.\\
\\
\\
\\
Watch Webinars](/content/resources/webinar/index.html)

\\
\\
**Whitepapers** \\
\\
A free program designed to assess your readiness for Istio Ambient adoption and prove the business benefits based on your own environment.\\
\\
\\
\\
Read Whitepapers](/content/resources/white-paper/index.html)

\\
\\
**Gloo AI Gateway** \\
\\
Secure, observe, and control your AI applications with Gloo AI Gateway, the leading cloud native gateway built on Envoy.\\
\\
\\
\\
Learn more](/content/dev/backup/gloo-ai-gateway/index.html)

\\
\\
**Gloo Gateway** \\
\\
The future of cloud APIs is omni.\\
\\
\\
\\
Learn more](/content/products/kgateway/index.html)

\\
\\
**Gloo Mesh** \\
\\
Connecting, securing, controlling, and observing microservice communication is tough. We make it accessible to all.\\
\\
\\
\\
Learn more](/content/products/istio/index.html)

\\
\\
**Datasheets** \\
\\
\\
\\
Read Datasheets](/content/resources/datasheet/index.html)

\\
\\
**Infographics** \\
\\
\\
\\
Read Infographics](/content/resources/infographic/index.html)

\\
\\
**Videos** \\
\\
\\
\\
Watch Videos](/content/resources/video/index.html)

## Cloud connectivity done right

[Get started](/content/get-started/index.html)