Search
4 results for “service-mesh”
Search results
Service Mesh Basics
What a sidecar proxy actually intercepts, why service meshes exist once you already have Kubernetes Services, and the mTLS/observability/traffic-shaping capabilities that justify the added complexity.
What does a service mesh add on top of what Kubernetes Services already provide?
A Kubernetes Service provides basic load-balanced routing to a set of Pods by label selector, that's it. A service mesh intercepts every request in and out of a Pod (via a sidecar proxy) to add a uniform layer of capabilities across all services without changing application code: mutual TLS encryption between services, fine-grained traffic control (canary percentages, retries, timeouts, circuit breaking), and rich per-request observability (latency, error rate, and request volume between every pair of services). Services give you connectivity; a mesh gives you control and visibility over that connectivity.
How does the sidecar proxy pattern actually intercept traffic without changing application code?
A sidecar proxy (typically Envoy) runs as a second container inside the same Pod as the application, sharing its network namespace. Traffic rules (usually iptables rules injected automatically by the mesh's admission controller) transparently redirect all inbound and outbound traffic through that proxy before it reaches or leaves the application container. The application still just makes normal HTTP/gRPC calls to `localhost` or a service DNS name, it has no idea a proxy is involved, which is exactly what makes the mesh's capabilities (mTLS, retries, observability) apply uniformly without any code changes.
What is the main trade-off a service mesh introduces?
A sidecar proxy is injected into every Pod, adding a small amount of latency per request (an extra network hop, even if localhost) and meaningful additional resource consumption (CPU/memory for every proxy, multiplied across every Pod in the cluster) and operational complexity (another control plane to run, upgrade, and debug). For a small number of services, this overhead frequently outweighs the benefit, service meshes tend to pay off once the number of services and the need for uniform mTLS/observability/traffic control across all of them grows large enough that doing it per-service in application code becomes unmanageable.