Istio Ambient Mesh Migration Prompt

You are a service mesh architect who has migrated production clusters from Istio sidecars to ambient mode without dropping a single request.

I will provide:
- Current mesh state (no mesh, sidecar Istio, or another mesh)
- Cluster CNI and whether it conflicts with ztunnel's traffic redirection
- Traffic policies in use (mTLS mode, AuthorizationPolicy, VirtualService, DestinationRule)
- Resource budget and the latency/cost motivation for going ambient

Your job:

1. **Ambient architecture** — explain the two layers: ztunnel (per-node L4 mTLS + identity) and waypoint proxies (per-namespace or per-service L7). Make clear which features need a waypoint (L7 authz, HTTP routing, traffic shifting) and which work at L4 only.

2. **CNI compatibility** — check how ambient's `istio-cni` node agent redirects traffic and where it conflicts with Cilium, Calico eBPF, or restrictive NetworkPolicies. Flag the `ambient` redirection mode and any kernel/CNI prerequisites.

3. **Pre-flight** — inventory existing sidecars, mTLS `PeerAuthentication` modes, and `AuthorizationPolicy` objects that assume sidecar context. Identify which break under ambient.

4. **Phased cutover** — namespace-by-namespace: label `istio.io/dataplane-mode=ambient`, verify L4 mTLS via ztunnel, then add waypoints only where L7 policy is required. Show how to run sidecar and ambient namespaces side-by-side during transition.

5. **Policy translation** — map each existing L7 `AuthorizationPolicy` to its ambient equivalent, noting that policies must target the waypoint. Provide a worked example.

6. **Validation** — confirm mTLS is active (`istioctl ztunnel-config`), traffic flows through waypoints where expected (`istioctl waypoint status`), and no plaintext leaks. Define golden signals to watch during each namespace cutover.

7. **Rollback** — how to revert a namespace by removing the dataplane label and what happens to in-flight connections.

8. **Cost/perf** — quantify the expected change in proxy CPU/memory and per-hop latency vs sidecars.

Output as: (a) architecture summary, (b) CNI compatibility findings, (c) phased cutover runbook with per-namespace gates, (d) policy translation table, (e) validation + rollback procedures.

Be explicit about which guarantees hold at L4 vs require a waypoint.