Sidecar Proxy

The Deployment Shape

 every pod gets a proxy container beside the app:

 ┌── pod ─────────────────────────┐
 │ ┌─────────────┐ ┌────────────┐ │
 │ │ app: orders │ │ envoy      │ │
 │ │ :8080       │ │ sidecar    │ │
 │ └──────▲──────┘ └─────▲──────┘ │
 │        │ localhost    │ mTLS   │
 │        └── iptables ──┘        │
 └────────────────────────────────┘

 traffic interception (usually iptables redirect):
 - outbound: app → transparently → sidecar → remote peer's sidecar
 - inbound:  remote → sidecar (mTLS, policy) → app :8080

 app code believes it talks plain HTTP to peers;
 the mesh wraps everything beneath it.

What the Sidecar Handles Per Hop

 OUTBOUND (calling):
 □ resolve + pick endpoint (mesh LB, zone-aware)
 □ originate mTLS with SPIFFE identity
 □ apply retry/timeout/circuit policy from mesh config
 □ emit client-side metrics + trace span

 INBOUND (receiving):
 □ terminate mTLS, verify caller identity
 □ enforce authorization ("reviews may GET products")
 □ local rate limiting, fault injection for tests
 □ emit server-side metrics + request logs

 two proxies = the trust boundary and the telemetry point.
 that's the entire trick.

The Resource Conversation

 honest accounting at fleet scale:

 per-pod overhead: ~0.1–0.5 vCPU idle-ish, 50–150MB RAM
   (plus tail-latency ~0.5–2ms/hop)

 1000 pods × 100MB = 100GB RAM just for proxies.
 plus: pod startup slower (extra container), scheduling
 pressure, proxy version-skew management.

 mitigations over time:
 - tuned envoy configs (trim unused stats!)
 - cgroup/priority isolation so apps aren't starved
 - ambient/sidecar-less modes (own lesson) for cost-sensitive fleets

Concern	Reality
App crash-looping?	sidecar keeps running; readiness gates matter
Sidecar upgrade	rolling, per-pod restarts — plan waves
Debugging	kubectl exec into BOTH containers
Localhost trust	compromised pod ≠ compromised MESH peers (identity is per-pod)

Interview Framing

“Explain how mesh traffic actually flows between two pods” scored shape: dual-sidecar diagram with interception mechanism named (iptables), outbound/inbound duty lists, mTLS hop-by-hop property, resource-overhead arithmetic volunteered with mitigation mention. Flow-level fluency here is what separates people who’ve debugged meshes from people who’ve installed them.