Architecture
Service Mesh
A service mesh provides infrastructure-level networking, observability, and security for microservices. It abstracts cross-cutting concerns from application code into a dedicated layer.
- Sidecar Proxy â Each service gets a local proxy for traffic management
- mTLS â Automatic encryption between all services
- Traffic Management â Routing, retries, circuit breaking
Service mesh moves networking logic out of application code into the infrastructure.
What Is a Service Mesh?
A dedicated infrastructure layer for handling service-to-service communication.
Sidecar Pattern
Each service instance gets a proxy that intercepts all network traffic.
Envoy Proxy
| Feature | Description |
|---|---|
| Load Balancing | Round-robin, least requests, consistent hashing |
| Circuit Breaking | Conconnection limits, outlier detection |
| Retries | Automatic retries with exponential backoff |
| Health Checks | Active and passive health checking |
| Tracing | Built-in distributed tracing support |
| mTLS | Automatic mutual TLS between services |
Istio Architecture
Traffic Management
| Capability | Description |
|---|---|
| Traffic Routing | Route by header, URI, or weight |
| Canary Deployments | Gradually shift traffic to new versions |
| A/B Testing | Route specific users to different versions |
| Fault Injection | Simulate failures for resilience testing |
| Circuit Breaking | Prevent cascade failures |
mTLS (Mutual TLS)
Automatic encryption between all services in the mesh.
mTLS Benefits
- Encryption â All traffic encrypted in transit
- Authentication â Verify identity of both parties
- Authorization â Policy-based access control
- Certificate Rotation â Automatic, short-lived certificates
- Zero Trust â No implicit trust between services
Observability
Service mesh provides automatic observability without code changes.
| Signal | Description | Tool |
|---|---|---|
| Metrics | Request rate, latency, error rate | Prometheus |
| Traces | Request path through services | Jaeger, Zipkin |
| Access Logs | Detailed request/response logs | Fluentd |
| Service Graph | Visualize service dependencies | Kiali |
Trade-offs
| Aspect | Without Mesh | With Mesh |
|---|---|---|
| Complexity | Lower | Higher |
| Latency | Lower (no proxy hop) | Higher (~1-2ms per hop) |
| Resource usage | Lower | Higher (sidecar memory/CPU) |
| Security | Manual mTLS setup | Automatic mTLS |
| Observability | Manual instrumentation | Automatic |
| Traffic management | In application code | In infrastructure |
Practice Exercises
-
Design: Design a service mesh architecture for a microservices app with 20 services. Include traffic management for canary deployments and automatic mTLS.
-
Comparison: Compare Istio, Linkerd, and Consul Connect for a Kubernetes deployment. When would you choose each?
-
Latency: A request passes through 5 services, each with a sidecar proxy adding 1ms. Calculate the total proxy overhead. How does this compare to application processing time?
-
Migration: A team has 50 microservices without a service mesh. Design a phased rollout plan that minimizes risk.
What to Learn Next
-> Containerization Docker, Kubernetes, pod scheduling, and auto-scaling.
-> Proxy and Reverse Proxy Forward proxy, Nginx, HAProxy, and SSL termination.
-> Observability Logging, metrics, tracing, and monitoring.
-> Security Patterns Authentication, authorization, encryption, and mTLS.
-> CI/CD Pipelines Continuous integration and deployment strategies.
-> Load Balancing Distribution algorithms and L4 vs L7 load balancing.