What is a Service Mesh and How Does it Compare to Kubernetes

What is Service Mesh?

A service mesh is a layer for a microservices application that you can configure. The mesh provides flexible, reliable, and fast microservice discovery, load balancing, encryption, authentication, and authorization.

The typical way to implement a service mesh is by providing a proxy instance, called a sidecar, for each service instance. Sidecars handle inter‑service communications, monitoring, security‑related concerns—anything that can be abstracted away from the individual services. This way, developers can focus on developing, supporting, and maintaining the application code in the services; operations can maintain the service mesh and run the app.

With a Service Mesh, you can separate the application's business logic from observability and network and security policies. The Service Mesh will enable you to connect, secure, and monitor your microservices.

• Connect: A Service Mesh provides a way for services to discover and talk to each other. It also allows for more effective routing to manage the flow of traffic and API calls between services/endpoints. 
• Secure: A Service Mesh offers you reliable communication between services. You can use a Service Mesh to enforce policies to allow or deny the connection. For example, you can configure a system to deny access to production services from a client service running in a development environment.
• Monitor: A Service Mesh enables the visibility of your microservices system. Service Mesh can integrate with out-of-the-box monitoring tools such as Prometheus and Jaeger.

These key features provide control over the behavior of the entire network of distributed microservices that make up a complex cloud-native application.

How a Service Mesh and Kubernetes Work Together

If you are deploying only a base Kubernetes cluster without a Service Mesh, you will run into the following issues:

• There is no security between services.
• Tracing a service latency problem is a severe challenge.
• Load balancing is limited.

As you can see, a Service Mesh adds a missing layer currently absent in Kubernetes. In other words, a service mesh complements Kubernetes.

Who is Building Service Mesh Solutions?

The three leading Service Mesh providers are:

• Consul
• Istio
• Linkerd

Let’s review each one in more detail.

Consul

Consul is a full-feature service management framework. Consul started as a way to manage services running on Nomad and has grown to support multiple other data centers and container management platforms, including Kubernetes.

Additional information is available at Consul.io.

Istio

Istio is a Kubernetes-native solution. Istio was developed by Lyft and now has backing and support from Google, IBM, and Microsoft.  

Istio split its data and control planes by using a sidecar-loaded proxy. The sidecar caches information so that it does not need to go back to the control plane for every call. A Kubernetes cluster is used to manage the control planes as pods. This arrangement offers better resilience if there is a failure of a single pod in any part of the service mesh.

Additional information is available at Istio.io.

Linkerd

Linkerd is also a popular Service Mesh run on top of Kubernetes and, due to its rewrite in v2, its architecture is very close to Istio’s. The difference is that Linkerd places a focus on simplicity

Additional information is available at Linkerd.io.

Next Steps

A Service Mesh is not a solution that you can stand up and have run by itself. A service mesh must be tied into your DevOps strategy. For the next steps, you will want to put in place the following:

• You will want to have solutions running in the cloud.
• Your solutions should be using Containers (such as Docker).
• You will want to be using Kubernetes to manage your Containers in the Cloud.

With these three steps, you now have the base setup for running a Service Mesh. I have found that Istio is easier to set up with AWS, Microsoft Azure, Google Cloud, and IBM. The reason is that each vendor is investing development into Istio. Also, the DevOps community around Istio is more robust than competing products. With that said, the Service Mesh market is still very new. There is a lot of opportunity for other products to come out and offer an easier setup and more functionality.

The bottom line is that this is a space worth watching. Monitor changes applied to Istio and other products, and choose to test new products frequently as the market matures. 

To become more proficient with Kubernetes and related tools, you may wish to pursue Simplilearn’s courses in DevOps or the comprehensive DevOps certification Program.  If you want to strengthen your cloud computing skills, consider Simplilearn’s courses in AWS, Azure, and Google Cloud technology, or the Simplilearn Cloud Architect Master’s Program that covers all three cloud platforms.