#60716·istio

Is sidecar/ambient coexistence supported across clusters (cross-mode, cross-cluster) in a multi-network mesh?

Author: yankunsamCreated Jun 27, 2026Updated Sep 30, 2026
Labelskind/docsarea/networkinglifecycle/stalearea/ambient

Question / clarification request

I'm running a mesh where sidecar and ambient data planes coexist, across two clusters, and I'd like to understand the currently supported behavior (and the intended roadmap) for cross-cluster traffic between the two modes.

Setup

  • Istio version: 1.27.3, one revision (1-27-3)
  • Topology: multi-primary, multi-network (two clusters, different network IDs)
  • Pods are not directly routable across clusters (traffic must traverse east-west gateways)
  • Both data planes coexist:
    • Classic east-west gateway (AUTO_PASSTHROUGH, :15443) for sidecar
    • Ambient east-west gateway (gatewayClassName: istio-east-west, HBONE :15008) for ambient
  • ServiceScope/global is used to expose services across clusters

What I'm trying to confirm

For a multi-network multi-cluster mesh with both modes present, is cross-cluster traffic supported in each of these directions, and as of which version?

  1. sidecar (cluster A) → ambient (cluster B) — cross-cluster
  2. ambient (cluster A) → sidecar (cluster B) — cross-cluster
  3. ambient (cluster A) → ambient (cluster B) routed via an L7 waypoint whose HTTPRoute/VirtualService backend resolves to a global service in the remote cluster (i.e. does a waypoint correctly resolve cross-cluster global-service endpoints?)

Observed behavior

  • sidecar → remote ambient: works.
  • ambient → remote sidecar (via east-west gateway, pods not directly routable): fails. The ambient east-west gateway terminates the (double-)HBONE connection but there is no ztunnel socket to hand off to on the sidecar side.
  • waypoint → remote (cross-cluster) global service backend: the waypoint route is programmed correctly (VirtualService is translated, route points at the remote service's outbound|... cluster), but that cluster has no endpoints on the waypoint, resulting in no healthy upstream (503 UH). global label, remote secret, and ambient east-west gateway are in place.

What I'd like to know

  • Is each of the three directions above supported today, and if so, in which Istio version (1.27 alpha vs 1.29 beta vs 1.30)?
  • Specifically, is cross-cluster cross-mode (sidecar ↔ ambient across clusters when pods are not directly routable) on the roadmap, and is it tracked by existing work? (I believe there is related work around letting a sidecar accept traffic from the ambient east-west gateway — please point me to the canonical issue/PR if so.)
  • Is a waypoint resolving a backend to a remote-cluster global service expected to work in multi-network multicluster, and from which version?
  • If any of these are not yet supported on 1.27.x, is the recommended path simply to upgrade to 1.29+/1.30 and align both ends of each cross-cluster call to the same data-plane mode?

Affected product area (please put an X in all that apply)

  • Ambient
  • Networking
  • Docs
  • Installation
  • Security
  • Performance and Scalability

Additional context

Documentation states ambient multi-network multicluster reached Beta in 1.29 and that single-network multicluster is untested. It would help to have an explicit support matrix for mixed sidecar/ambient cross-cluster scenarios.