Service Mesh
A service mesh is a dedicated infrastructure layer for service-to-service communication in microservices. Sidecar proxies (Envoy) handle mTLS, retries, circuit breaking, and observability transparently – without application code changes. Istio, Linkerd, and Consul Connect are the major implementations.
Definition
A service mesh decouples networking concerns from application code by injecting sidecar proxies alongside each service instance. Every network call passes through the local sidecar, which handles: mutual TLS (automatic encryption and identity verification between services), retries with backoff, circuit breaking (stop calling failing services), load balancing (client-side, with health awareness), rate limiting, and observability (distributed tracing, metrics, access logs). The control plane (Istio's istiod, Linkerd's control plane) configures all sidecars centrally – operators define policies (timeout=5s, retries=3, circuit-break-after=5-errors) without changing application code. Service meshes add latency (~1-3ms per hop from proxy overhead) and operational complexity (managing the mesh itself). They are justified when: you have 20+ services, need zero-trust mTLS everywhere, require consistent observability across polyglot services, or need traffic management (canary releases, traffic mirroring).
Examples
- –Istio: kubectl apply -f virtual-service-canary.yaml (90% v1, 10% v2)
- –Linkerd: linkerd inject deploy.yaml | kubectl apply -f - (adds sidecar)
- –Consul Connect: intentions define which services can communicate
Related Protocols
Related Terms
Load Balancer
A load balancer distributes incoming traffic across multiple backend servers to prevent any single server from becoming overwhelmed. Layer 4 (TCP) load balancers route by IP/port. Layer 7 (HTTP) load balancers can route by URL path, headers, or cookies. Health checks remove failed backends automatically.
Sidecar Proxy
A sidecar proxy is a helper container deployed alongside each application container in Kubernetes. It intercepts all inbound and outbound network traffic, applying policies (mTLS, retries, rate limits) without application modification. Envoy is the dominant sidecar proxy, used by Istio, AWS App Mesh, and Consul Connect.
Circuit Breaker
A circuit breaker stops calling a failing downstream service after a threshold of errors, preventing cascade failures. States: Closed (normal flow), Open (all calls fail-fast without attempting), Half-Open (limited test calls to check recovery). Prevents a slow/failing service from consuming all caller resources and propagating failure upstream.