Service Mesh with Istio

As microservice architectures grow, managing service-to-service communication becomes increasingly complex. A service mesh provides traffic management, security, and observability without modifying application code. This lesson covers Istio's architecture, traffic routing, security features, and deployment strategies.

---

What Is a Service Mesh?

A service mesh is a dedicated infrastructure layer that handles service-to-service communication. It works by deploying a sidecar proxy alongside every application container.

┌────────────────────────────────┐
│  Pod                           │
│  ┌──────────┐  ┌────────────┐ │
│  │ App      │──│ Envoy      │ │
│  │ Container│  │ Sidecar    │ │
│  └──────────┘  └─────┬──────┘ │
└──────────────────────┼─────────┘
                       │
                       ▼
              ┌──────────────┐
              │ Istiod       │
              │ (Control     │
              │  Plane)      │
              └──────────────┘

Why Use a Service Mesh?

Concern	Without Mesh	With Mesh (Istio)
mTLS encryption	Each app implements TLS	Automatic, zero-code
Traffic splitting	Custom load balancer	Declarative YAML
Retries / timeouts	Application code	Mesh configuration
Observability	Instrument each service	Automatic metrics/tracing
Access control	Application-level auth	Policy-driven

---

Installing Istio

# Download Istio
curl -L https://istio.io/downloadIstio | sh -
cd istio-1.20.0
export PATH=$PWD/bin:$PATH