CodeBlanks Logo Icon CodeBlanks
Login Register

What is a service mesh?

Learn that a service mesh provides traffic management.

What is a service mesh?

A service mesh is an infrastructure layer that manages network traffic between services without changing application code. A proxy (sidecar) is placed next to each pod, or node-level proxies are used; all traffic passes through these proxies. That way these features are added centrally:

  • Traffic management: canary, retries, timeouts, circuit breaking
  • Security: automatic mTLS between services, authorization policies
  • Observability: metrics and distributed tracing for every request
api ──► [envoy] ═══ mTLS ═══ [envoy] ──► db
         ▲ retries, metrics, policy

Options

Common meshes:

  • Istio: the most comprehensive; Envoy sidecars or the sidecar-less "ambient" mode.
  • Linkerd: lightweight, simple to install; its own proxy written in Rust.
  • Cilium Service Mesh: at the kernel level with eBPF, sidecar-less.
istioctl install --set profile=default -y
kubectl get pods -n istio-system
NAME                                    READY   STATUS
istiod-7b9c8d6f5-x2k9p                  1/1     Running
istio-ingressgateway-5c6d7e8f9-a1b2c    1/1     Running

Practice Install Istio

Write two commands: install Istio with the default profile without asking for confirmation; list the pods in istio-system.

Starter code

terminal
# buraya yaz

Sample solution

terminal
istioctl install --set profile=default -y
kubectl get pods -n istio-system

Expected output

✔ Istio core installed
✔ Istiod installed
✔ Ingress gateways installed
✔ Installation complete
NAME                                    READY   STATUS    RESTARTS   AGE
istio-ingressgateway-5c6d7e8f9-a1b2c    1/1     Running   0          40s
istiod-7b9c8d6f5-x2k9p                  1/1     Running   0          55s

Questions and answers

Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.

1 What is the main advantage of a service mesh?

  • Taking database backups
  • Shrinking image size
  • Providing retries, mTLS and metrics without coding them into each application separately Correct answer
  • Speeding up pods

Explanation: The cost is extra latency and operational complexity.

2 Install Istio with the default profile.

Question 
istioctl install --set ____=default -y
Answer 
istioctl install --set profile=default -y

Explanation: profile is a ready configuration set (default, demo, minimal).

3 Match.

Term Meaning
Istio Envoy-based, comprehensive
Linkerd Lightweight mesh
Cilium eBPF-based
sidecar Proxy beside the pod

All lessons in Expert

1 Kubernetes internals

  1. What is etcd?
  2. kube-scheduler
  3. controller-manager
  4. kube-apiserver
  5. Reconcile loop
  6. Summary - Internals

2 Custom Resource Definition

  1. What is a CRD?
  2. CRD YAML
  3. Custom resource
  4. Spec and status
  5. Validation
  6. Summary - CRD

3 Operator pattern

  1. What is an Operator?
  2. Controller logic
  3. Operator SDK
  4. Custom resource management
  5. Example operator
  6. Summary - Operator

4 Service mesh - Istio

  1. What is a service mesh?
  2. What is Istio?
  3. Envoy sidecar
  4. Traffic management
  5. mTLS
  6. Summary - Service mesh

5 Multi-cluster

  1. What is multi-cluster?
  2. Cluster federation
  3. Kubeconfig
  4. Cross-cluster service
  5. Cluster registry
  6. Summary - Multi-cluster

6 OPA and Gatekeeper

  1. What is OPA?
  2. The Rego language
  3. What is Gatekeeper?
  4. ConstraintTemplate
  5. Constraint
  6. Summary - OPA

7 Disaster recovery

  1. Backup strategy
  2. etcd backup
  3. Velero
  4. Restore process
  5. RPO and RTO
  6. Summary - Disaster recovery

8 Expert final

  1. Challenge - CRD
  2. Challenge - Operator
  3. Challenge - Istio
  4. Challenge - OPA
  5. Challenge - Expert project