Solo Enterprise for Istio

What it does

Solo Enterprise for Istio is an enterprise distribution of the Istio service mesh that secures traffic between Kubernetes, virtual-machine, and Amazon ECS workloads. It is built on ambient mode, a sidecarless data plane. A shared ztunnel proxy on each node enforces mutual TLS (mTLS) and Layer 4 authorization, and optional waypoint proxies apply Layer 7 policy. Workloads join the mesh when their namespace is labelled, with no sidecar injection. Solo adds hardened images, FIPS builds, and security patches for the four previous Istio releases.

How it works

The platform authenticates every service-to-service connection with X.509 workload identities issued through SPIFFE and SPIRE, and it authorizes traffic by identity rather than IP address and port. Authorization policies match HTTP and gRPC methods and paths at waypoint proxies, and Common Expression Language (CEL) rules evaluate workload claims. Egress gateways constrain outbound traffic. Multicluster peering connects the control planes of separate clusters and routes global service names through east-west gateways. Extensions for Amazon ECS, AWS Lambda, and virtual machines bring non-Kubernetes workloads into the same mesh.

Credentials and traction

Solo.io holds SOC 2 Type II certification. Gartner named Solo.io a Visionary in the 2024 Magic Quadrant for API Management, its second consecutive placement. Solo.io engineers hold seats on the Istio Steering Committee and Technical Oversight Committee and co-created ambient mode. Customers include T-Mobile, BMW, ADP, Carfax, USAA, Zscaler, and Confluent, which runs the platform across more than 100 services with full mutual TLS coverage. T-Mobile runs workloads handling roughly 150 million transactions per day on it.