Service mesh

A service mesh is an infrastructure layer that manages network traffic between services in a cluster. It adds mutual TLS (mTLS) encryption, identity-based access policy, retries, traffic splitting and telemetry, without changes to application code. Istio is the most widely used open-source mesh. Its ambient mode removes the per-pod sidecar proxy that older meshes required.

How it works

In sidecar mode, Istio injects an Envoy proxy into every pod, and all traffic flows through it. In ambient mode, a shared ztunnel proxy on each node handles mTLS and layer 4 policy, and optional waypoint proxies add layer 7 rules such as HTTP routing. For example, a cluster with 20 nodes and 400 pods runs 20 ztunnels instead of 400 sidecars. An AuthorizationPolicy can then allow only the checkout service account to call payments.

Why it matters in production

A mesh gives workload-level isolation and encryption when network-level controls are weak, such as on a flat on-prem network. It also adds moving parts to upgrade, debug and pay for in CPU and memory. Teams should adopt it for a concrete need such as zero-trust policy, not by default.