A service mesh adds a layer of infrastructure between microservices, handling mTLS, retries, circuit breaking, and traffic routing via sidecar proxies (Envoy). Istio uses sidecar injection; Linkerd uses a lighter Rust-based proxy. VirtualService and DestinationRule control traffic routing — enabling canary deployments (5% → 100%) and A/B testing at the infrastructure level. Service meshes provide L7 metrics (request rate, error rate, latency) for every service-to-service call without code changes.
Progressive canary rollout using Istio traffic weights.
kubectl rolling update moves all traffic gradually but affects all users. Istio VirtualService weight routing lets you send exactly 5% of traffic to canary while keeping 95% on stable — instant rollback.
Setting PeerAuthentication to STRICT mode enforces that every service-to-service call uses mTLS. This eliminates a whole category of lateral movement attacks with zero application code changes.
Envoy sidecar emits RPS, error rate, and p50/p99 latency for every service pair. With Kiali + Prometheus, you get a service topology dashboard without adding any metrics code to your services.
Sign in to share your feedback and join the discussion.