Features

User-facing capabilities of the mesh, indexed by what users do with Istio. Most features cut across multiple systems; the pages here trace each capability from the user-visible surface down through the implementation.

Feature	What users do	Where it's implemented
Traffic management	Route, retry, mirror, fault-inject	pilot/pkg/networking/core/, VirtualService, DestinationRule, Gateway
mTLS and identity	Encrypt traffic, verify identity, JWT auth	security/, PeerAuthentication, RequestAuthentication, AuthorizationPolicy
Multi-cluster	Span a mesh across clusters	pkg/kube/multicluster/, pilot/pkg/serviceregistry/, MeshNetworks
Ambient mode	Sidecarless mesh: ztunnel + waypoints	pilot/pkg/serviceregistry/kube/controller/ambient/, pkg/workloadapi/
Observability	Metrics, tracing, access logs, telemetry	Telemetry, OTel/Zipkin/Datadog providers
Gateway API	Kubernetes-native gateways and waypoints	pilot/pkg/config/kube/gateway/, manifests/charts/gateway/
VM workloads	Add VMs to the mesh	WorkloadEntry, WorkloadGroup, pilot-agent on the VM
Wasm and EnvoyFilter	Extend the data plane	WasmPlugin, EnvoyFilter, ECDS

Each page follows the same shape: what users see → primary CRD(s) → translation pipeline → relevant systems → key files → trade-offs.