Stop reading whenever you have enough

Service mesh, in twelve questions.

Each one is the question the previous answer makes you ask. The ones that matter come with the command, because that is the part you meet at work.

Not technical? This whole page is written for you. It is the one topic in this track that needs no cluster at all.

Rungs
12
Hands on
2
Read
~8 min
01

What it is

01–03

Every program that talks over a network repeats the same chores. A mesh moves those chores out of the programs.

the idea, with no software named yet · for anyone

  1. 01

    What problem is this solving?

    Not knowing this costs

    Five teams, five languages, five subtly different retry bugs.

    • Programs that call each other repeat the same chores
    • Retry, encrypt, time out, measure, route
    • Every team rebuilds them, slightly differently, forever
  2. 02

    What is the mesh answer?

    Not knowing this costs

    One implementation of the chores, owned once, for every language.

    • Move the chores out of the programs entirely
    • A small helper runs beside each one: the sidecar proxy
    • All traffic flows through the helpers
  3. 03

    Why beside each program, not in front of everything?

    Not knowing this costs

    The edge proxy era already existed. Its blind spot is why this does.

    • A central proxy only sees traffic that crosses it
    • Service to service calls would bypass it entirely
    • Beside every program means seeing every call

Before you scroll on

0/3

You should now be able to

02

How the world got here

04–06

Teams solved these chores in libraries first. The libraries are why the mesh looks the way it does.

why this exists, as a short history · for anyone curious why it is shaped this way

  1. 04

    What came before the mesh?

    Not knowing this costs

    A security fix in a library is a hundred deploys. In a mesh, one.

    • Libraries inside each app: Hystrix, Ribbon, and kin
    • Powerful, and rewritten per language
    • Upgrading meant rebuilding every service that used them
  2. 05

    What finally broke the library model?

    Not knowing this costs

    The chores belong to the network, and libraries pinned them to languages.

    • Teams stopped sharing one language
    • Every new language re owed the whole library
    • The proxy speaks the network, so language stops mattering
  3. 06

    What did moving to a proxy trade away?

    Not knowing this costs

    Days get lost debugging apps by teams who forget the second layer exists.

    • Behaviour left the code and moved to config
    • A developer reading the app no longer sees retries or routing
    • Debugging now spans two layers instead of one

Before you scroll on

0/3

You should now be able to

03

Seeing it

07–08

Two commands make the invisible layer visible.

the mesh made visible in a cluster · for whoever has a cluster to poke

  1. 07

    How do I spot a meshed pod?

    hands on

    Not knowing this costs

    A 1/1 pod is invisible to every mesh feature you configure.

    • Two containers where the app needs one
    • The second is the proxy, injected at creation
    shellthe tell is the 2/2
    kubectl get pods -n payments

# NAME                READY   STATUS
# payment-svc-7d9c    2/2     Running   <- app + proxy: meshed
# legacy-batch-x1     1/1     Running   <- no proxy: outside the mesh
    That 2/2 is the entire mesh, from the pod point of view. Every capability in this track rides inside that second container.
  2. 08

    What manages all those proxies?

    hands on

    Not knowing this costs

    Traffic flows through proxies. If istiod dies, traffic keeps flowing on last config.

    • One control plane, istiod, configures every proxy
    • Proxies carry traffic, istiod never does
    • Data plane and control plane, in two words
    shellthe fleet, from the top
    istioctl proxy-status

# NAME                      CDS     LDS     EDS     RDS     ISTIOD
# payment-svc-7d9c.payments SYNCED  SYNCED  SYNCED  SYNCED  istiod-7b4f
# checkout-x2k1.checkout    SYNCED  SYNCED  SYNCED  SYNCED  istiod-7b4f
    Every row is a proxy, every column a slice of its config, SYNCED meaning it holds what istiod last pushed. This one command is the mesh wide health check.

Before you scroll on

0/3

You should now be able to

04

What it costs

09–10

Nothing this useful is free, and the bill has three lines.

the honest bill · for whoever has to defend the decision

  1. 09

    What is the bill?

    Not knowing this costs

    The third line is the one that actually cancels mesh projects.

    • Latency: roughly a millisecond added per hop
    • Resources: CPU and memory per pod, for the proxy
    • People: a platform to run, upgrade, and understand
  2. 10

    When is a mesh the wrong answer?

    Not knowing this costs

    A mesh for four services is operational cost with no crime to solve.

    • A monolith, or a handful of services
    • One language, one team, no compliance pressure
    • The chores are cheaper in code at that size

Before you scroll on

0/3

You should now be able to

05

Where it ends

11–12

A mesh manages the space between services, and only that.

the boundary of what a mesh does · for whoever reviews the architecture

  1. 11

    What never leaves the application?

    Not knowing this costs

    The mesh retries requests. Only the app knows which ones it must not.

    • Business logic, obviously, but also business errors
    • Fallbacks: what to show when a call fails
    • Whether an operation is safe to retry
  2. 12

    What does this page unlock?

    Not knowing this costs

    Every later topic assumes the picture on this page.

    • Everything else in this track configures that second container
    • Routing, security, resilience: all proxy behaviour
    • Next: the proxy itself, which is Envoy

Before you scroll on

0/3

You should now be able to

Go deeper

3 links, each earning its place.

What is a service mesh, by Istio↗

The official framing of the problem this page compresses.

Pattern: Service Mesh, by Morgan Bruce↗

The classic essay on the library to sidecar evolution from rungs 4 to 6.

Istio architecture overview↗

The data plane and control plane picture from rung 8, drawn properly.

Where this leaves you

Rungs 1 to 3 are the idea. Rung 7 is the idea made visible in one kubectl command.

If you keep one thing: a mesh moves the network chores out of every program into one place beside each program. Everything else in this track is configuring that place.