Why service mesh matters in Kubernetes - Why It Works

Introduction

When many small apps talk to each other inside a system, it can get messy and hard to control. A service mesh helps by managing how these apps connect, making communication safe and reliable without changing the apps themselves.

When you have many small services that need to talk to each other securely inside a Kubernetes cluster

When you want to track and control how data moves between your apps without changing their code

When you need to automatically retry failed requests or balance traffic between services

When you want to add security like encryption between services without extra work in each app

When you want to see detailed logs and metrics about how your services communicate

Commands

Create a special space in Kubernetes to hold the service mesh components safely separated from your apps.

Terminal

kubectl create namespace istio-system

Expected Output

namespace/istio-system created

Install the minimal Istio service mesh operator in the istio-system namespace to manage the service mesh lifecycle.

Terminal

kubectl apply -f https://github.com/istio/istio/releases/download/1.18.2/istio-minimal-operator.yaml -n istio-system

Expected Output

customresourcedefinition.apiextensions.k8s.io/istiooperators.install.istio.io created

serviceaccount/istio-operator created

clusterrole.rbac.authorization.k8s.io/istio-operator created

clusterrolebinding.rbac.authorization.k8s.io/istio-operator created

deployment.apps/istio-operator created

→

-n - Specifies the namespace where the resources are created

Apply a simple Istio control plane configuration to start the service mesh with minimal features.

Terminal

kubectl apply -f - <<EOF
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  namespace: istio-system
  name: example-istiocontrolplane
spec:
  profile: minimal
EOF

Expected Output

istiocontrolplane.install.istio.io/example-istiocontrolplane created

Tell Kubernetes to automatically add service mesh features to all apps in the default namespace.

Terminal

kubectl label namespace default istio-injection=enabled

Expected Output

namespace/default labeled

Check that the service mesh components are running properly in the istio-system namespace.

Terminal

kubectl get pods -n istio-system

Expected Output

NAME                                   READY   STATUS    RESTARTS   AGE

istio-operator-5f6d7f7b7d-abcde       1/1     Running   0          1m

→

-n - Shows pods in the specified namespace

Key Concept

If you remember nothing else from this pattern, remember: a service mesh manages how many small apps talk to each other safely and reliably without changing their code.

Common Mistakes

Not enabling automatic sidecar injection in the app namespace

Without this, the service mesh features won't be added to your apps, so you won't get the benefits.

Always label your app namespace with istio-injection=enabled to add service mesh features automatically.

Installing the service mesh components in the wrong namespace

Service mesh components must be in a dedicated namespace like istio-system to avoid conflicts and for proper management.

Create and use the istio-system namespace for all service mesh components.

Summary

Create a dedicated namespace for service mesh components to keep them organized.

Install the service mesh operator and control plane to manage communication between services.

Enable automatic injection of service mesh features in your app namespace for easy integration.

Verify that service mesh components are running to ensure proper setup.