Skip to main content

Illumio Segmentation for Containers

Illumio and Istio Ambient Support

Organizations running Istio Ambient Service Mesh can deploy Illumio C-VEN alongside it without losing the ability to maintain visibility and enforce segmentation policies. Before 5.11.0, Istio traffic redirection could interfere with C-VEN’s ability to observe and enforce pod traffic correctly. This limitation is resolved.

How it works

Istio Ambient uses a node-level proxy called ztunnel. When a pod is enrolled in the mesh, Istio redirects its traffic through ztunnel using iptables rules.

Previously, these traffic redirects could interfere with C-VEN visibility, as C-VEN might observe redirected or tunneled traffic rather than the original pod-to-pod flow.

In 5.11.0, Illumio addresses this with a two-part approach:

  1. Kubelink, Illumio’s Kubernetes integration component, detects when a pod is enrolled in the Istio Ambient mesh and sends C-VEN a flag indicating that the pod is on-mesh.

  2. C-VEN uses packet marks in iptables/nftables chains before Istio’s redirect rules are processed. This allows C-VEN to apply segmentation policy based on the original traffic intent before ztunnel redirects or tunnels the traffic, while enforcement and logging continue after redirection.

The result is that Illumio policy enforcement remains intact, while C-VEN can correctly enforce supported pod-to-pod, pod-to-node, and ClusterIP traffic flows.

Supported use cases

Illumio supports core segmentation, traffic visibility, and enforcement use cases across these paths with Istio Ambient:

Traffic Path

Supported

Pod-to-pod, direct/cross-node

Yes

Pod-to-pod through a ClusterIP Service

Yes

Node-to-pod / pod-to-node

Yes

Pod-to-node

Yes

Mixed Mesh Scenarios

Mixed environments are also supported; not all pods need to be enrolled in the mesh.

  • Both pods on the mesh : Full Illumio enforcement; ztunnel carries traffic through an HBONE tunnel between nodes.

  • Only the source pod is on the mesh : C-VEN enforces traffic on both sides; traffic exits ztunnel toward the off-mesh destination pod.

  • Only the destination pod is on the mesh : C-VEN enforces traffic on both sides; inbound traffic follows the applicable ztunnel path.

Prerequisites

  • CLAS Mode

    Illumio must be deployed in CLAS mode (CloudSecure/Kubernetes mode).

    See Cluster Local Actor Store (CLAS).

    Traditional VEN deployment does not support Istio Ambient.

  • Infrastructure Rules for Istio Ports

    You must create Illumio infrastructure rules to allow required Istio system traffic. Without these rules, Istio communication may be blocked.

    Source

    Destination

    Port

    Enables

    Pod, Node

    Pod

    15008 TCP

    Mesh destination port

    Node

    Istio ztunnel Pods

    15021 TCP

    Health/readiness probe

Known limitations

  1. Traffic Flow Reporting Looks Different

    C-VEN reports the actual post-redirection flows it observes at the network layer rather than the original application-level intent. For example:

    • When both pods are on the mesh, C-VEN on the source side may report traffic such as:

      src_pod → 127.0.0.1:15001

    • On the destination side, C-VEN may report:

      src_pod → dst_pod:15008

    For ClusterIP traffic, the ClusterIP service address may not be visible in PCE flows because ztunnel resolves and load-balances the traffic before Illumio observes it.

    What this means for rule authoring: Write policies based on pod-to-pod identity, such as labels and workload identity, rather than derived exclusively from observed traffic flows.

    Auto-policy suggestions based on traffic flows may show destinations such as :15001 or :15008, which is expected behavior.

  2. Native nftables Mode Is Not Supported

    This Istio installation option --set values.global.nativeNftables=true is not supported.

    The following modes are supported:

    • Legacy iptables (iptables)

    • iptables-nft bridge mode (iptables-nft)

FAQs

We already use Istio for mTLS. Why do we need Illumio?

Istio mTLS secures communication between services in the mesh. Illumio provides network segmentation policy and enforcement across the environment, including workloads and traffic that may not be covered by service-mesh controls.

The two technologies address different security layers and can be complementary.

Will Illumio interfere with Istio AuthorizationPolicies?

No. Illumio operates at the network layer, while Istio AuthorizationPolicies are enforced through Istio’s service-mesh components. The controls are designed to coexist and provide complementary enforcement layers.

Do all pods need to be enrolled in the mesh?

No. Mixed environments, where some pods are enrolled in Istio Ambient and others are not, are supported.

What Istio version or deployment mode is required?

This capability applies specifically to Istio Ambient mode, not traditional Istio sidecar mode.