Hardening Kubernetes Security with Istio Ambient Mode on Flat Networks

If you’ve moved a workload off AWS and onto on-prem infrastructure, you’ve likely run into this: the network isolation you got for free on the cloud does not exist on bare metal. On AWS, Security Groups and VPC boundaries enforce service boundaries quietly in the background. Most teams never have to think about it.