Is sidecar/ambient coexistence supported across clusters (cross-mode, cross-cluster) in a multi-network mesh?
Author: yankunsamCreated Jun 27, 2026Updated Sep 30, 2026
Labelskind/docsarea/networkinglifecycle/stalearea/ambient
Question / clarification request
I'm running a mesh where sidecar and ambient data planes coexist, across two clusters, and I'd like to understand the currently supported behavior (and the intended roadmap) for cross-cluster traffic between the two modes.
Setup
- Istio version: 1.27.3, one revision (
1-27-3) - Topology: multi-primary, multi-network (two clusters, different network IDs)
- Pods are not directly routable across clusters (traffic must traverse east-west gateways)
- Both data planes coexist:
- Classic east-west gateway (
AUTO_PASSTHROUGH, :15443) for sidecar - Ambient east-west gateway (
gatewayClassName: istio-east-west, HBONE :15008) for ambient
- Classic east-west gateway (
- ServiceScope/global is used to expose services across clusters
What I'm trying to confirm
For a multi-network multi-cluster mesh with both modes present, is cross-cluster traffic supported in each of these directions, and as of which version?
- sidecar (cluster A) → ambient (cluster B) — cross-cluster
- ambient (cluster A) → sidecar (cluster B) — cross-cluster
- ambient (cluster A) → ambient (cluster B) routed via an L7 waypoint whose
HTTPRoute/VirtualServicebackend resolves to a global service in the remote cluster (i.e. does a waypoint correctly resolve cross-cluster global-service endpoints?)
Observed behavior
- sidecar → remote ambient: works.
- ambient → remote sidecar (via east-west gateway, pods not directly routable): fails. The ambient east-west gateway terminates the (double-)HBONE connection but there is no ztunnel socket to hand off to on the sidecar side.
- waypoint → remote (cross-cluster) global service backend: the waypoint route is programmed correctly (VirtualService is translated, route points at the remote service's
outbound|...cluster), but that cluster has no endpoints on the waypoint, resulting inno healthy upstream(503 UH). global label, remote secret, and ambient east-west gateway are in place.
What I'd like to know
- Is each of the three directions above supported today, and if so, in which Istio version (1.27 alpha vs 1.29 beta vs 1.30)?
- Specifically, is cross-cluster cross-mode (sidecar ↔ ambient across clusters when pods are not directly routable) on the roadmap, and is it tracked by existing work? (I believe there is related work around letting a sidecar accept traffic from the ambient east-west gateway — please point me to the canonical issue/PR if so.)
- Is a waypoint resolving a backend to a remote-cluster global service expected to work in multi-network multicluster, and from which version?
- If any of these are not yet supported on 1.27.x, is the recommended path simply to upgrade to 1.29+/1.30 and align both ends of each cross-cluster call to the same data-plane mode?
Affected product area (please put an X in all that apply)
- Ambient
- Networking
- Docs
- Installation
- Security
- Performance and Scalability
Additional context
Documentation states ambient multi-network multicluster reached Beta in 1.29 and that single-network multicluster is untested. It would help to have an explicit support matrix for mixed sidecar/ambient cross-cluster scenarios.
Source: istio/istio