Everyone says EBPF killed the service mesh sidecar. It didn't. The proxy is still running. It just moved somewhere you're not looking. The old way. Every pod gets its own Envoy proxy. At a thousand requests a second, that's two tenths of a CPU and 60 megs of RAM. Each. 70 pods? 14 CPUs burned. And all 70 are running identical config. So Istio's ambient mode deduplicated them. One shared proxy per node. They call it Stunnel. It's doing mutual TLS for every pod on that box. 5 CPUs instead of 14. And the CPU cost of MTLS drops from about 24% to under 5. But EBPF can't finish the job. The kernel verifier won't let it reassemble an HTTP header split across packets. So the second you need path routing or a canary split, you deploy a waypoint. A full envoy that costs roughly what a sidecar did. You just run fewer of them. You never removed the proxy. You shared it. And a shared node proxy means one noisy tenant can starve every workload on that box. Something a sidecar could never do. Smaller bill, bigger blast radius.
Machine-transcribed from the published render, so acronyms may be cased as ordinary words.