Service Mesh & Ingress

Control Plane

• Configuration management: Centralized configuration for all mesh policies
• Policy enforcement: Implementing security, traffic, and access policies
• Certificate management: Handling TLS certificates for secure communication
• API integration: Exposing APIs for mesh configuration and monitoring
• Service discovery: Maintaining a registry of available services and endpoints

Data Plane

• Proxies (sidecars): Lightweight network proxies (like Envoy) deployed alongside each service
• Traffic routing: Dynamic request routing based on various attributes like headers, paths
• Load balancing: Advanced load balancing with support for various algorithms and health checking
• Circuit breaking: Preventing cascading failures by detecting and isolating failing services
• Telemetry collection: Gathering detailed metrics, logs, and traces for each request

Istio

• Comprehensive platform: Complete solution with extensive features
• Built on Envoy proxy: Leverages Envoy's powerful capabilities as sidecar
• Strong traffic management: Advanced routing, splitting, and mirroring capabilities
• Robust security features: Built-in mTLS, RBAC, and certificate management
• Deep observability: Integrated with Prometheus, Grafana, Jaeger, and Kiali
• Enterprise adoption: Backed by Google and widely used in production environments

Linkerd

• Lightweight and simple: Smaller resource footprint than alternatives
• Minimal overhead: <1ms p99 latency impact on service calls
• Fast data plane: Written in Rust for performance and memory safety
• Focused on simplicity: Easy installation and intuitive operation
• Strong security defaults: Automatic mTLS without complex configuration
• CNCF graduated project: Industry-recognized maturity and stability

Consul

• Service discovery: Robust service registry with health checking
• Multi-platform: Works in Kubernetes, VMs, and bare metal environments
• Key-value store: Built-in distributed key-value storage
• ACL support: Fine-grained access control system
• Network segmentation: Service-to-service authorization with intentions
• HashiCorp ecosystem: Integrates with Vault, Nomad, and other HashiCorp tools

NGINX Ingress Controller

• Most common: Widely adopted in the Kubernetes ecosystem
• Production-grade: Battle-tested in large-scale deployments
• HTTP load balancing: Advanced load balancing algorithms and features
• Path-based routing: Flexible routing based on URL paths and hosts
• TLS termination: Efficient SSL/TLS handling with optional passthrough
• Extensive annotations: Rich set of configuration options via annotations
• Commercial support: Available through NGINX, Inc. (F5)

Traefik

• Dynamic configuration: Auto-detects changes and reconfigures without restarts
• Automatic Let's Encrypt: Built-in ACME support for free TLS certificates
• Dashboard UI: Visual management interface for monitoring and configuration
• Middleware support: Pluggable middleware chain for request processing
• Modern architecture: Built for cloud-native and microservices environments
• Multiple protocols: Supports HTTP, HTTPS, TCP, gRPC, and WebSocket
• Canary deployments: Native support for traffic splitting and canary releases

HAProxy

• High performance: Optimized for speed and low latency
• Advanced load balancing: Sophisticated algorithms and health checking
• Detailed metrics: Comprehensive statistics and monitoring capabilities
• Connection management: Fine-grained control over connection pools
• Custom rules: Powerful ACLs and routing rules
• Enterprise features: Rate limiting, circuit breaking, and DDoS protection
• Low resource usage: Efficient memory and CPU utilization

Istio Gateway

apiVersion: networking.istio.io/v1alpha3
kind: Gateway
metadata:
  name: bookinfo-gateway
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "bookinfo.example.com"

Istio Virtual Service

apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: bookinfo
spec:
  hosts:
  - "bookinfo.example.com"
  gateways:
  - bookinfo-gateway
  http:
  - match:
    - uri:
        prefix: /reviews
    route:
    - destination:
        host: reviews
        port:
          number: 9080

Performance Considerations

• Sidecar resource requirements
• Control plane sizing
• Selective mesh inclusion
• Monitoring overhead
• Proxy latency impact

Security Implementation

• mTLS configuration
• Authorization policies
• Certificate management
• Network policies
• Service-to-service authentication

Service Mesh Issues

• Sidecar injection failures:
  # Check if automatic injection is enabled
  kubectl get namespace -L istio-injection
  
  # Verify pod has sidecar injected
  kubectl get pod <pod-name> -o jsonpath='{.spec.containers[*].name}'
  

• mTLS configuration problems:
  # Verify mTLS policy
  kubectl get peerauthentication -A
  
  # Test connection between services
  istioctl x describe pod <pod-name>
  

• Routing misconfiguration:
  # Validate virtual service
  istioctl analyze virtualservice/<name>
  
  # Check if routes are applied
  istioctl proxy-config routes <pod-name>.<namespace>
  

• Control plane connectivity:
  # Check control plane pods
  kubectl get pods -n istio-system
  
  # Verify istiod connectivity
  istioctl proxy-status
  

• Telemetry collection issues:
  # Check if Prometheus is scraping metrics
  kubectl port-forward -n istio-system svc/prometheus 9090:9090
  # Then open http://localhost:9090 in browser
  
  # Verify traces are being collected
  kubectl port-forward -n istio-system svc/jaeger 16686:16686
  # Then open http://localhost:16686 in browser
  

Ingress Issues

• Certificate problems:
  # Check TLS secret
  kubectl get secret <tls-secret-name> -o yaml
  
  # Verify certificate is valid
  kubectl get secret <tls-secret-name> -o jsonpath='{.data.tls\.crt}' | base64 -d | openssl x509 -text -noout
  

• Routing errors:
  # Validate Ingress resource
  kubectl describe ingress <ingress-name>
  
  # Check Ingress controller logs
  kubectl logs -n ingress-nginx deploy/ingress-nginx-controller
  

• Backend connectivity:
  # Test service connectivity from inside cluster
  kubectl run -it --rm debug --image=curlimages/curl -- curl http://<service-name>.<namespace>.svc.cluster.local:<port>
  
  # Check endpoints for service
  kubectl get endpoints <service-name>
  

• Configuration validation:
  # Verify Ingress configuration
  kubectl get ingress <ingress-name> -o yaml
  
  # Check for controller-specific issues
  kubectl get events --field-selector involvedObject.kind=Ingress
  

• Resource constraints:
  # Check resource usage
  kubectl top pods -n ingress-nginx
  
  # Verify resource requests and limits
  kubectl describe deploy -n ingress-nginx ingress-nginx-controller