What is a Service Mesh?
Learn what a service mesh is — sidecar proxies, control plane, mTLS, traffic management and observability — with a DevOps interview answer.
Expected Interview Answer
A service mesh is an infrastructure layer that handles service-to-service communication for you by injecting a lightweight proxy alongside every service instance, so traffic management, security, and observability are handled outside the application code.
Each service gets a sidecar proxy — commonly Envoy in a mesh like Istio or Linkerd — that intercepts all inbound and outbound traffic for that service. A control plane configures every sidecar centrally, letting you apply retries, timeouts, load balancing, and canary traffic splitting without changing application code. The mesh also secures traffic with automatic mutual TLS between services and produces uniform observability — metrics, logs, and traces — for every call, since all traffic passes through the proxies. This moves cross-cutting networking concerns out of each microservice and into a consistent, centrally managed layer, at the cost of added operational complexity and per-request proxy latency.
- Uniform traffic management (retries, timeouts, canary splits) without app code changes
- Automatic mutual TLS encryption between services
- Consistent observability — metrics, logs, traces — across every service call
- Decouples cross-cutting networking concerns from application logic
AI Mentor Explanation
A service mesh is like every player having a personal translator-cum-security escort who handles all their communication with other players on the field, rather than players shouting instructions directly at each other. The escort applies the same rules for everyone — relaying calls clearly, verifying the other player’s identity, and logging every exchange — set centrally by the team manager, not decided by each player individually. If a call needs to be repeated because it was missed, the escort retries automatically without the batter having to think about it. This keeps communication rules consistent across the whole team without changing how any individual player plays.
Step-by-Step Explanation
Step 1
Inject sidecar proxies
A lightweight proxy is deployed alongside each service instance to intercept its traffic.
Step 2
Configure via control plane
Central configuration pushes routing, retry, and security policy to every sidecar.
Step 3
Manage traffic
The mesh applies load balancing, retries, timeouts, and canary traffic splitting between services.
Step 4
Secure and observe
Mutual TLS encrypts service-to-service calls, and every request produces consistent metrics, logs, and traces.
What Interviewer Expects
- Sidecar proxy pattern and its role intercepting traffic
- Control plane vs data plane separation
- Traffic management features: retries, timeouts, canary splits
- Security (mTLS) and observability benefits, plus added complexity trade-off
Common Mistakes
- Confusing a service mesh with an API gateway
- Not mentioning the sidecar proxy pattern
- Ignoring the operational complexity and latency cost
- Thinking a service mesh requires changing application code
Best Answer (HR Friendly)
“A service mesh is a layer that manages how our different services talk to each other, without us having to build that logic into every service. It automatically encrypts traffic, retries failed calls, and gives us consistent visibility into every request — at the cost of some added infrastructure to run and manage.”
Code Example
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
name: web
spec:
hosts:
- web
http:
- route:
- destination:
host: web
subset: v1
weight: 90
- destination:
host: web
subset: v2
weight: 10Follow-up Questions
- What is the difference between the mesh control plane and data plane?
- How does a service mesh differ from an API gateway?
- What overhead does a sidecar proxy add?
- How does a service mesh achieve mutual TLS between services?
MCQ Practice
1. What component intercepts traffic for each service instance in a service mesh?
A sidecar proxy runs alongside each service instance and intercepts its inbound and outbound traffic.
2. What does the service mesh control plane do?
The control plane centrally manages configuration such as routing rules and security policy, distributing it to the data-plane proxies.
3. What is a key trade-off of adopting a service mesh?
A service mesh centralizes networking concerns but adds operational complexity and a small latency cost from the extra proxy hop.
Flash Cards
What is a service mesh? — An infrastructure layer using sidecar proxies to manage service-to-service traffic, security, and observability.
What is a sidecar proxy? — A lightweight proxy deployed alongside each service instance that intercepts its traffic.
What does the control plane do? — Centrally configures routing, retries, and security policy pushed to every sidecar.
Name two service mesh benefits. — Automatic mutual TLS and consistent observability across every service call.