Container Platform with Service Mesh

Overview

This architecture adds a service mesh to a Kubernetes platform so that cross-cutting concerns, encryption, retries, traffic shifting, and telemetry, are handled by infrastructure rather than application code. Use it when you run dozens or hundreds of services and want consistent security and observability without modifying each service. The mesh moves these capabilities into a sidecar proxy next to every workload.

Istio with Envoy sidecars is the reference choice, though the pattern applies equally to lighter meshes.

Components

• Kubernetes: Orchestrates workloads and the mesh control plane.
• Istio: Control plane that programs proxies, issues workload identities, and defines routing policy.
• Envoy: Sidecar proxy that intercepts all pod traffic and enforces mesh policy.
• cert-manager: Automates certificate issuance and rotation for mesh and ingress.
• Prometheus and Grafana: Collect and visualize the mesh-emitted golden signals.
• Jaeger: Stores and queries distributed traces stitched together by the proxies.
• Argo CD: GitOps delivery of both platform and application manifests.

Data Flow

Every request between services passes through the source and destination Envoy proxies. The proxies establish mutual TLS, apply retry and timeout policy, and emit metrics and trace spans automatically. The Istio control plane pushes routing rules to proxies via the xDS API, enabling canary traffic splits without redeploying services. Ingress traffic enters through an Istio gateway, which terminates external TLS and routes into the mesh. Telemetry flows to Prometheus and Jaeger for a unified view.

Scaling and Resilience

The mesh enforces resilience uniformly: per-route retries, timeouts, circuit breaking, and outlier detection eject unhealthy endpoints. Locality-aware load balancing keeps traffic in-zone to reduce latency and cost. The control plane runs with multiple replicas; proxies cache configuration and keep routing even if the control plane is briefly unavailable. Horizontal Pod Autoscaling scales both application pods and gateways. Traffic mirroring lets you test new versions with real load before promoting them.

Security

The mesh implements zero-trust networking: every workload gets a cryptographic identity, and mTLS encrypts all east-west traffic by default. Authorization policies allow or deny calls by identity, not IP. cert-manager rotates certificates automatically. Combined with Pod Security Standards and network policies, the mesh provides defense in depth. Egress can be locked to known destinations through egress gateways.

Trade-offs and Alternatives

A service mesh delivers consistent security and observability, but it adds a proxy per pod, raising latency and resource use, and the control plane is another system to operate and upgrade. For small fleets, the overhead rarely pays off; library-based resilience or an API gateway alone may suffice. Lighter meshes such as Linkerd reduce complexity at the cost of features, and ambient-mode meshes remove sidecars to cut overhead. Adopt a mesh when uniform mTLS, fine-grained traffic control, and zero-instrumentation telemetry across many services justify the operational cost.