What it provides
- Traffic management — canary deployments, A/B testing, retries, timeouts, inter-service rate limiting
- Security — automatic mTLS between all services. Zero Trust at the network level
- Observability — automatic latency, error rate, and tracing metrics between services with no code changes
- Circuit Breaking — protection from cascading failures at the proxy level
How it works
A sidecar container (Envoy) runs alongside each Pod. All inbound and outbound traffic passes through it. The control plane (Istiod) configures all proxies centrally.
Popular solutions
Istio (most popular), Linkerd (simpler), Consul Connect.