Istio's ambient mode creates a fork in the road for users onboarding with OpenShift Service Mesh that they did not have before. Once the operator is installed, it creates a separate onboarding path and a separate upgrade path for users. We should validate the ambient lifecycle on OpenShift, as well as enough tests to have confident in our downstream builds (but not overly duplicate upstream testing).

For GAing ambient mode, we need to ensure that we have test coverage and documentation that covers:

• Getting started with ambient mode in a greenfield (no existing mesh) cluster, including both ZTunnels and Waypoints
• Getting started with ambient mode on a cluster with existing sidecar workloads (Assume OSSM 3.1 as min version)
  • Both with just ZTunnels and with Waypoints
  • We should aim to support ambient dataplane namespaces alongside sidecar namespaces.
• Guidance on migrating workloads from sidecar to ambient mode. There is no requirement for zero downtime here, but we should give some guidance on the best procedure as of today. This can be very minimal and can be modified as upstream has better support.
• Upgrading OSSM with ambient mode:
  • Upgrading ZTunnel
  • Upgrading Waypoints
  • Upgrading application workloads (in theory, there is nothing to do here, but we should state that explicitly, because w/ sidecars pods needed to be bounced).
• Validate the multi-cluster ambient feature in Istio 1.27, and determine what our support level should be.
• We should also document what features are supported (or not supported) in Ambient vs sidecar mode.

Keep "upstream first" in mind:

• We should re-use and not duplicate upstream testing or docs
• Contribute to upstream testing where gaps are identified
  • Keep in mind that unlike Envoy, ZTunnel is an Istio-only component and does not receive testing outside of Istio
• Optimize downstream testing
• Most lifecycle procedures (install, upgrade, anything w/ sail operator) will require downstream product doc, even if docs exist in the sail-operator Github repo.

Not part of this epic:

• Performance testing (to be handled by the perf team).