Service Mesh Basics
In plain Kubernetes, pods can communicate directly with other pods and services. Furthermore, services can be exposed to the outside world using LoadBalancers or Ingress Controllers, and rules for communication can be defined in Network Policies.
These mechanisms are good for basic use cases, but as applications and environments grow, they often reach their limits. Some of the questions that arise are:
- How can I enforce encryption between services?
- How can I enforce authentication and authorization between services?
- Can I get insights into the communication between services?
- How can traffic be gradually shifted between different versions of a service?
These are just a few of the questions that arise when building and operating modern applications. Although there are solutions for many of these problems, they may require additional effort to implement and maintain in each application or service.
Service Meshes address these challenges by putting a component (typically a sidecar proxy) next to each service instance. This component intercepts all incoming and outgoing traffic and can apply rules and policies to it. This way, the service itself does not need to implement these features, but can rely on the Service Mesh to do so. A service mesh typically consists of a control plane and a data plane. The control plane is responsible for managing the configuration and policies of the service mesh, while the data plane is responsible for handling the actual traffic between services.
In summary, one could say that a Service Mesh consists of sidecar proxies (or other mechanisms) and a control plane that manages them. In recent years, service meshes have evolved and there are approaches that do not require sidecar proxies, but instead use eBPF or other mechanisms to intercept traffic. However, the basic principles remain the same.
There are many different service meshes available, each with its own strengths and weaknesses. In this lab, we will use Istio, which is one of the most popular service meshes and has a large community and ecosystem.