Service Mesh Traffic Policy Builder

A service mesh is an infrastructure layer that manages service-to-service communication. It handles retries, timeouts, circuit breaking, mutual TLS, and observability transparently — without changing application code. You typically need one when you have 10+ microservices, need fine-grained traffic control (canary deployments, A/B testing), require mTLS between services, or want distributed tracing without SDK changes. Istio and Linkerd are the two dominant open-source options.

Istio uses Envoy as its sidecar proxy, offering rich traffic management (VirtualService, DestinationRule, Gateway CRDs), fine-grained authorization policies, and extensive Envoy filter support. It's more powerful but more complex to operate. Linkerd uses a lightweight Rust-based proxy (linkerd2-proxy), is simpler to install and operate, has lower resource overhead, and focuses on reliability. Linkerd uses ServiceProfile CRDs for per-route policy. Choose Istio for advanced traffic management; Linkerd for simplicity and performance.

A circuit breaker monitors calls to a downstream service. When the error rate or consecutive failures exceed a threshold, it 'opens' — subsequent calls fail fast without hitting the overloaded service, giving it time to recover. After a timeout, it enters 'half-open' state and allows a test request. If successful, it closes. In Istio this is implemented via DestinationRule outlierDetection: consecutive5xxErrors triggers ejection of unhealthy endpoints from the load balancer pool.

Connection pool settings limit how many concurrent connections and requests your service proxy will allow to a backend. http1MaxPendingRequests limits queued requests waiting for a connection slot. maxRequestsPerConnection controls keep-alive multiplexing — setting it to 1 forces a new connection per request (useful for load balancing with older protocols). tcp.maxConnections limits total TCP connections. Proper tuning prevents a slow downstream service from consuming all available connections and starving other services.

In Istio, outlier detection IS the circuit breaker implementation, but at the endpoint level. Rather than a per-service switch, it ejects individual pod IPs (endpoints) that show errors. consecutiveGatewayErrors counts 5xx responses. interval is how often to check. baseEjectionTime is the minimum ejection duration (doubles on repeated ejections). maxEjectionPercent prevents all endpoints from being ejected simultaneously. This is more granular than a traditional circuit breaker because a single bad pod gets ejected while healthy pods continue serving traffic.