Sequence Flow — message order between components

One diagram per path; each tab is one path from the source. The node-level view of the same paths is on 02 · Node datapaths A · B · C and 03 · Canary split D1 · D2.

A · Standard Kubernetes

Client → MetalLB (VIP) → Gateway API (HTTPRoute) → Pod-A → veth-A → kube-proxy → Calico → NIC-1

B · Ambient — Redirection

· namespace label ENABLED — Client → MetalLB (VIP) → Gateway API (HTTPRoute) → Pod-A → veth-A → istio-cni → ztunnel → kube-proxy → Calico → NIC-1

C · Ambient — Bypass

· namespace NOT labeled — Client → MetalLB (VIP) → Gateway API (HTTPRoute) → Pod-A → veth-A → istio-cni → (ztunnel bypassed) → kube-proxy → Calico → NIC-1

D · RKE2 (Guest) Ingress canary

D · Harvester RKE2 (Guest) Ingress canary egress · HTTPRoute 90 / 10 weighted split — Client → Gateway API (Envoy · HTTPRoute) → 90%: istio-cni → ztunnel → Calico → Mesh Pod · 10%: istio-cni → Calico → External VM