What is a Service Mesh?
A service mesh adds a sidecar proxy (typically Envoy) to every pod. The proxy handles mTLS, load balancing, retries, circuit breaking, and observability — transparently, without application code changes.
Popular Service Meshes
- Istio: Most feature-rich. Uses Envoy sidecars. Strong security model with PeerAuthentication and AuthorizationPolicy.
- Linkerd: Lightweight, Rust-based proxy. Simpler than Istio, focuses on reliability and observability.
- Envoy (standalone): The proxy itself, used directly without a full mesh control plane.
Service Mesh + SPIFFE
SPIRE can replace the mesh's built-in CA for stronger workload attestation, cross-cluster federation, and identity for non-mesh workloads (VMs, CI/CD).