Service Mesh Deep Dive¶

🎯 Learning Objectives

Understand service mesh architecture
Master Istio and Linkerd operations
Learn traffic management and security
Troubleshoot service mesh issues
Implement advanced mesh patterns

Service meshes provide advanced traffic management, security, and observability. Understanding service mesh internals is essential for complex microservices deployments.

Service Mesh Benefits

Service meshes provide: mTLS, traffic management, observability, and security policies without code changes.

Complexity Trade-off

Service meshes add complexity. Ensure benefits outweigh operational overhead.

Service Mesh Architecture¶

Components¶

Data Plane: - Sidecar proxies (Envoy, Linkerd-proxy) - Intercept and manage traffic

Control Plane: - Configuration and policy management - Service discovery - Certificate management

Sidecar Pattern

Service meshes use sidecar containers to inject functionality without modifying applications.

Istio¶

Installation¶

# Install Istio
istioctl install --set profile=default

# Enable sidecar injection
kubectl label namespace default istio-injection=enabled

Traffic Management¶

# VirtualService
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews
spec:
  hosts:
  - reviews
  http:
  - match:
    - headers:
        end-user:
          exact: jason
    route:
    - destination:
        host: reviews
        subset: v2
  - route:
    - destination:
        host: reviews
        subset: v1
      weight: 50
    - destination:
        host: reviews
        subset: v3
      weight: 50

Traffic Splitting

Use VirtualService for canary deployments, A/B testing, and traffic shifting.

Security¶

# PeerAuthentication
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: STRICT

mTLS Impact

STRICT mTLS requires all services to have sidecars. Plan migration carefully.

Troubleshooting¶

Common Issues¶

Sidecar Not Injected¶

# Check injection label
kubectl get namespace default -o jsonpath='{.metadata.labels}'

# Check sidecar
kubectl get pod <pod-name> -o jsonpath='{.spec.containers[*].name}'

# Manual injection
kubectl apply -f <(istioctl kube-inject -f deployment.yaml)

Traffic Not Routing Correctly¶

# Check VirtualService
kubectl get virtualservice

# Check DestinationRule
kubectl get destinationrule

# Check Envoy config
istioctl proxy-config route <pod-name>

Best Practices¶

Production Recommendations

Start with permissive mTLS, then move to STRICT
Monitor service mesh metrics
Use gradual rollout for mesh adoption
Document traffic policies
Test failure scenarios
Monitor sidecar resource usage

Next Chapter: Ingress & Load Balancing