What is Service Mesh?
A dedicated infrastructure layer for managing service-to-service communication in microservices, providing mTLS encryption, retries, observability, and traffic routing without modifying application code.
A service mesh is a dedicated infrastructure layer that handles all service-to-service communication within a microservices architecture. It typically consists of a set of lightweight proxy servers (sidecars) deployed alongside each service instance, plus a centralized control plane. The sidecar proxies intercept all inbound and outbound traffic, applying policies for encryption, authentication, routing, and reliability. The control plane distributes configuration, manages certificates, and collects telemetry data.
The most common implementation uses the Envoy proxy as the sidecar, with control planes like Istio, Linkerd, or Consul Connect. When a service sends a request, the local sidecar intercepts it, performs mutual TLS (mTLS) handshake with the destination sidecar, applies retry and timeout policies, and forwards the request. The destination sidecar then passes it to the target service. This pattern decouples networking concerns from business logic, allowing developers to focus on application code while operators manage traffic policies centrally.
Service meshes are most often deployed in Kubernetes environments but can work with other orchestrators. They provide observability through metrics, logs, and distributed tracing, enabling teams to monitor service health and performance. By abstracting away complex networking tasks, a service mesh reduces the burden on individual services and improves overall system resilience and security.
Key facts
- Service mesh uses sidecar proxies to intercept and manage all inter-service traffic.
- Provides automatic mutual TLS (mTLS) encryption between services.
- Implements retry logic, timeouts, and circuit breaking to improve resilience.
- Offers observability through metrics, logs, and distributed tracing.
- Enables fine-grained traffic routing for canary deployments and A/B testing.
How it works in practice
Related terms
References
More in Containers & Orchestration
ConfigMap
A ConfigMap is a Kubernetes API object used to store non-confidential configuration data in key-value pairs, which pods can consume as environment variables, command-line arguments, or configuration files.
Container
A container is a lightweight, isolated runtime that packages an application with its dependencies using OS-level virtualization, enabling consistent execution across environments.
Container Image
A container image is a lightweight, standalone, executable package that includes everything needed to run a piece of software: code, runtime, system tools, libraries, and settings. It is the unit of distribution in container ecosystems like Docker and Kubernetes.
Container Registry
A container registry is a service that stores and distributes container images, enabling developers to push, pull, and version images across environments.
Container Runtime
A container runtime is the low-level software that creates, starts, and stops containers according to the OCI runtime specification, enabling process isolation and resource management.
Docker
Docker is a platform and toolchain for packaging, distributing, and running applications inside lightweight, portable containers, popularising the technology from 2013 onward.
Helm
Helm is a package manager for Kubernetes that uses charts to define, install, and upgrade complex applications as a single, versioned unit.
Ingress Controller
An Ingress Controller is a Kubernetes component that watches Ingress resources and configures a reverse proxy to route external HTTP and HTTPS traffic to services inside the cluster.
Init Container
An init container is a specialized container in a Kubernetes pod that runs to completion before any regular containers start, performing initialization or setup tasks.
Kubernetes
Kubernetes is an open source platform for automating the deployment, scaling, and management of containerized applications across clusters of hosts.