Designing Service Mesh Architecture

1. Understanding Service Mesh Concepts

ConceptDetail
Data planeSidecar / ambient proxy (Envoy)
Control planePushes config to proxies
Sidecar modePer-pod proxy
Ambient / sidecarlessPer-node proxy (Cilium, Istio Ambient)
ToolsIstio, Linkerd, Consul, Cilium Service Mesh

2. Designing Service-to-Service Communication

CapabilityDetail
Transparent mTLSAuto identity + encryption
Retries / timeoutsMesh-level config
Load balancingRound-robin, least-req, ring-hash
L7 routingHeader / path-based

3. Designing Traffic Management

PatternDetail
Weighted routingCanary 90/10
Header-basedx-env: canary → new version
MirroringShadow traffic
Outlier detectionEject unhealthy upstreams

4. Designing Service Discovery

MechanismDetail
DNSK8s Service DNS
Mesh registryFrom cluster API
Multi-clusterFederation / east-west gateway

5. Designing Mutual TLS (mTLS)

AspectDetail
IdentitySPIFFE / SPIRE
Cert rotationShort-lived, auto-rotated
PoliciesSTRICT mode in production
AuthorizationSource identity → allow rules

6. Designing Observability and Tracing

SignalDetail
Golden metricsRED auto-collected per service
Access logsL7 logs from sidecar
TracingAuto-propagation; needs context headers
DashboardsKiali / Linkerd-viz / Grafana

7. Designing Traffic Policies

PolicyDetail
DestinationRuleSubsets, LB algo, conn pool
VirtualServiceRouting rules
Retry budgetCap retries
Circuit breakerOutlier ejection thresholds

8. Designing Canary Deployments with Mesh

ToolDetail
Flagger / Argo RolloutsAutomated promotion
Metrics providerProm / Datadog
Auto-rollbackIf success rate drops
Header-based for testersInternal validation first

9. Designing Fault Injection Testing

TypeDetail
DelayAdd latency
AbortReturn 5xx
TargetedBy header / route
UseValidate retry / CB / fallback

10. Designing Rate Limiting at Mesh Level

ModeDetail
LocalPer-proxy; fast
GlobalExternal ratelimit service (Envoy RLS)
Per-routeApply selectively
Per-identityUse mTLS identity as key

11. Designing Service Mesh Security

ControlDetail
AuthorizationPolicyAllow service-A → service-B only
JWT validation at edgeReject unauth at ingress
Default denyAllow-list approach
AuditAll policy decisions logged

12. Designing Multi-Cluster Service Mesh

PatternDetail
Single mesh / multi-clusterShared root CA
East-west gatewayInter-cluster traffic
Federated discoveryCross-cluster endpoints
Locality-aware LBPrefer same-cluster