Service Mesh Concepts

What is a service mesh and when would you implement one? Explain the sidecar pattern.

Kubernetesintermediate

// interview question

What is a service mesh and when would you implement one? Explain the sidecar pattern.

Sample answer

A service mesh is a dedicated infrastructure layer for service-to-service communication, handling traffic management, security, and observability. It uses the sidecar pattern: a proxy container (like Envoy) runs alongside each service, intercepting all network traffic. Benefits: mutual TLS encryption, traffic splitting, retries/timeouts, and distributed tracing without code changes. Popular options: Istio, Linkerd, and Consul Connect. Implement when you have many microservices needing consistent networking policies.

Why this matters

As microservices grow, managing inter-service communication becomes complex. A service mesh extracts networking concerns from application code into infrastructure. The sidecar proxy handles all traffic, enabling features like circuit breaking and canary deployments transparently. However, it adds operational complexity and resource overhead - don't use it for simple architectures.

Code examples

Istio traffic splitting

yaml

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: reviews
spec:
  hosts:
  - reviews
  http:
  - route:
    - destination:
        host: reviews
        subset: v1
      weight: 90
    - destination:
        host: reviews
        subset: v2
      weight: 10  # 10% canary traffic

Retry and timeout policy

yaml

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: payments
spec:
  hosts:
  - payments
  http:
  - timeout: 10s
    retries:
      attempts: 3
      perTryTimeout: 3s
      retryOn: 5xx,reset,connect-failure
    route:
    - destination:
        host: payments

Common mistakes to avoid

Implementing a service mesh for a simple monolith or few services
Not accounting for increased resource usage from sidecar containers
Misconfiguring traffic policies causing cascading failures

Likely follow-ups

How does mutual TLS work in a service mesh?
What is the performance overhead of running a service mesh?
How do you debug issues when traffic passes through sidecar proxies?

Answer out loud first, then check yourself against the model answer.

Practice all Mid-Level questions More Kubernetes questions

#service-mesh#istio#kubernetes#microservices#networking

Also worth your time on this topic

Article

Istio Traffic Management: Routing, Retries, and Circuit Breaking

Configure weighted routing, automatic retries, and circuit breakers in Istio with copy-paste YAML examples and real kubectl output you can verify on your own cluster.

Interview

VirtualService vs DestinationRule

In Istio, what's the difference between a VirtualService and a DestinationRule? When would you use each?

junior

Checklist

Istio Traffic Management Checklist: Routing, Retries, and Circuit Breaking

How to configure traffic management policies in Istio so your services can do canary releases, retry transient failures, and shed load when a downstream service goes bad. Covers VirtualService, DestinationRule, retries, timeouts, circuit breakers, and outlier detection.

60-90 minutes

Service Mesh Concepts

More Kubernetes interview questions

Also worth your time on this topic

Istio Traffic Management: Routing, Retries, and Circuit Breaking

VirtualService vs DestinationRule

Istio Traffic Management Checklist: Routing, Retries, and Circuit Breaking