Service Mesh

What a Mesh Actually Is

 two planes:

 DATA plane: a proxy (sidecar) beside EVERY service instance.
   all traffic flows through these proxies.

 CONTROL plane: policy/telemetry brain configuring them all:
   istio/consul/linkerd-class. distributes config via xDS.

 ┌─ pod ─────────────┐
 │ [app]◄─►[sidecar]─┼──► mesh traffic ──►[peer's sidecar]◄─►[app]
 └───────────────────┘         ▲
                          [control plane]
                     mTLS certs ✓ routing rules ✓ telemetry ✓

 app code: unchanged, unaware, localhost-only calls.

What You Get

 □ MUTUAL TLS everywhere: service identity + encryption by
   default — the compliance checkbox that took years becomes config
 □ UNIFORM TRAFFIC MANAGEMENT: retries/timeouts/circuit-breaking/
   outlier-ejection as DECLARATIVE POLICY (no libraries!)
 □ CANARY/MIRRORING/WEIGHTED routing: L7 traffic control
   without app changes or ingress gymnastics
 □ GOLDEN TELEMETRY FREE: every hop emits consistent
   metrics/traces — observability parity across polyglot fleets
 □ AUTHORITY POLICIES: who-may-call-whom as reviewable manifests

The Honest Costs

 the mesh tax is real and recurring:

 - RESOURCE OVERHEAD: proxy CPU/RAM × every pod;
   meaningful at thousands of pods (budget it explicitly)
 - LATENCY ADDITION: ~ms per hop through proxies
   (fine for most; measure for hot paths)
 - OPERATIONAL COMPLEXITY: control-plane HA, version upgrades
   across hundreds of proxies, debug-through-the-mesh skills
 - DEBUGGING INDIRECTION: "which layer ate my header?" gains
   a new suspect; tooling must understand mesh topology
 - ORGANIZATIONAL RAMP: teams must learn declarative traffic
   policy; misuse creates novel failure modes

 verdict pattern adopted industry-wide:
 meshes earned their place at LARGE polyglot scale;
 below it they're expensive ceremony.

Adopting Without Drowning

 incremental path that works:

 1. START with mTLS + telemetry only (the clear wins)
    ambient/lighter modes reduce sidecar overhead where offered
 2. add RETRY/TIMEOUT policy to flaky paths first —
    immediate incident reduction visible
 3. traffic-shifting for deploys (canary at mesh level)
 4. multi-cluster federation LAST (hardest mode)

 success metric: platform team operates mesh;
 product teams barely notice it exists beyond better defaults.
 if feature teams are debugging mesh internals weekly,
 the rollout lost its way.

Estate	Mesh verdict
<10 services, one language	skip — libraries suffice
Polyglot, compliance-heavy, growing	adopt incrementally
Hundreds of services, multi-cluster	effectively mandatory

Interview Framing

“40 teams, 300 services, four languages, SOC2 pending — how do you get uniform security and traffic policy?” scored answer: mesh architecture drawn (data/control planes), capability list mapped to their asks (mTLS→SOC2!), honest cost ledger (resource math, ops ramp), incremental adoption plan starting mTLS+telemetry, success criterion stated (invisible-to-teams). Mesh questions test scale judgment twice: knowing what it does AND when it’s premature — show both.