Service Mesh

Controls the flow of requests between services with fine-grained routing rules. Enables advanced deployment strategies like canary deployments, blue-green rollouts, and A/B testing by splitting traffic based on headers, weights, or paths.

• Circuit Breaking: Automatically stops cascading failures by ejecting unhealthy hosts from the load balancing pool.
• Retry Logic: Configures automatic retries with exponential backoff for transient failures.
• Timeouts: Enforces maximum request durations to prevent resource exhaustion.

Provides deep visibility into service-to-service communication without requiring application code changes. The sidecar proxy generates distributed traces, metrics, and access logs for every request.

• Distributed Tracing: Correlates requests across multiple services using trace context propagation headers.
• Golden Signals: Automatically exports latency, traffic, error rate, and saturation metrics.
• Topology Graphs: Visualizes real-time service dependency maps for rapid debugging.

Implements zero-trust networking by transparently upgrading all service-to-service communication to mutually authenticated and encrypted channels. The control plane automates certificate lifecycle management.

• Certificate Rotation: Automatically issues, distributes, and rotates short-lived X.509 certificates.
• Authorization Policies: Enforces fine-grained access control based on service identity, namespace, or request attributes.
• Identity-Based Security: Shifts security from network-level IP rules to cryptographic workload identity.

Injects and tests failure conditions to build robust distributed systems. A service mesh enables chaos engineering by programmatically introducing faults without modifying application logic.

• Fault Injection: Deliberately introduces delays or aborts for a percentage of requests to test fallback mechanisms.
• Load Shedding: Prioritizes critical requests and rejects excess traffic when a service approaches overload.
• Outlier Detection: Passively monitors host behavior and ejects instances exhibiting anomalous error rates or latency.

Deploys a dedicated Layer 7 proxy alongside each service instance as a sidecar container. This pattern decouples network operations from business logic, enabling polyglot environments.

• Envoy Proxy: The de facto high-performance data plane proxy written in C++, handling all inbound and outbound traffic.
• Control Plane: Manages and configures the fleet of proxies, pushing routing rules, service discovery data, and certificates.
• Data Plane: The collection of sidecar proxies that enforce policies and route traffic at runtime.

Dynamically discovers healthy service endpoints and distributes requests using sophisticated algorithms. Eliminates the need for client-side service discovery libraries or external load balancers.

• Dynamic Endpoint Discovery: Integrates with orchestrators like Kubernetes to track pod lifecycle and IP changes.
• Advanced Load Balancing: Supports least request, ring hash, random, and locality-aware load balancing strategies.
• Health Checking: Actively probes service endpoints and passively monitors responses to maintain an accurate healthy host pool.

A CNCF-archived lightweight service mesh that implements the Service Mesh Interface (SMI) specification. OSM was designed for simplicity, using Envoy as its data plane and providing a minimal control plane focused on core SMI APIs: Traffic Access Control, Traffic Split, and Traffic Metrics. Its design emphasized direct mapping between SMI resources and Envoy configuration, making it an excellent reference implementation for understanding how service mesh abstractions translate to proxy-level rules.

The fundamental deployment pattern for a service mesh. A sidecar proxy is a dedicated, transparent network proxy (typically Envoy) deployed alongside each service instance in the same Kubernetes pod. It intercepts all inbound and outbound traffic, enforcing mTLS, collecting telemetry, and applying routing rules without requiring application code changes. This decouples network reliability logic from business logic.

The 'golden signals' of a distributed system—latency, traffic, errors, and saturation—are automatically exported by the mesh's sidecar proxies. A service mesh provides uniform, out-of-the-box observability without requiring instrumentation libraries in every service. Key outputs include:

• Distributed Tracing: Correlates a single request across dozens of microservices using trace context propagation.
• Metrics: Standardized RED (Rate, Errors, Duration) metrics scraped by Prometheus.
• Access Logging: Every L7 request logged with metadata.

The brain of the service mesh, responsible for configuring the fleet of sidecar proxies. It translates high-level routing rules and security policies into low-level proxy configuration via an API (often based on the xDS protocol). The control plane manages the service registry, certificate authority, and policy engine. Architecturally, it is separated from the data plane to ensure that a control plane outage does not interrupt existing traffic flows.