Service Mesh: Istio and Linkerd
Learn when a service mesh is worth it, and how Istio adds mTLS, traffic shifting, and resilience without code changes, compared with Linkerd and ambient.
What You'll Learn
Deciding Whether You Need a Service Mesh
acme-shop's platform now has cart-service calling payment-service, and the platform team has been asked: "Can we encrypt traffic between services...
Understanding Sidecars, Ambient, and the Control Plane
Every mesh has two parts: proxies that handle traffic, and a control plane that tells them what to do.
Installing Istio on the Lab Cluster
You will use istioctl and the demo profile, which is meant for learning.
Securing Traffic with mTLS
mTLS means mutual TLS: both sides present certificates and verify each other.
Shifting Traffic Between Versions
Once traffic flows through proxies, you can route it by weight. This is a mesh capability.
Making Calls Resilient
The first topic described a cascading failure. A mesh has three tools against it: timeouts, retries, and outlier detection.
Skills You'll Master
Curriculum Index11 topics
Deciding Whether You Need a Service Mesh
acme-shop's platform now has cart-service calling payment-service, and the platform team has been asked: "Can we...
Understanding Sidecars, Ambient, and the Control Plane
Every mesh has two parts: proxies that handle traffic, and a control plane that tells them what to do.
Installing Istio on the Lab Cluster
You will use istioctl and the demo profile, which is meant for learning.
Securing Traffic with mTLS
mTLS means mutual TLS: both sides present certificates and verify each other.
Shifting Traffic Between Versions
Once traffic flows through proxies, you can route it by weight. This is a mesh capability.
Making Calls Resilient
The first topic described a cascading failure.
Seeing Traffic with Kiali and Metrics
Because every request passes through a proxy, the mesh measures it for free.
Choosing between Istio, Ambient, and Linkerd
There is no universal winner. The choice depends on your team and your requirements.
Running the Hands-On Lab
You have been building the lab through the previous topics.
Quick Reference and Common Mistakes
Quick Reference Common Mistakes Switching to STRICT mTLS first.
What You Built and What Comes Next
You decided whether a mesh was needed, installed Istio, enforced mTLS between cart-service and payment-service and...
Career Impact
Roles that use the skills in this module.
DevOps Engineer
Site Reliability Engineer
Platform Engineer
Next Modules
Related Guides
Practice on the Coding Sheet
Not a software engineer sheet. Every problem comes from real DevOps, SRE, Platform and Cloud interviews, from your first script to a system you build yourself.
Open the Coding SheetFrequently Asked Questions
Most small clusters do not. A mesh pays off when many services call each other and you need encrypted traffic, consistent retries and timeouts, or controlled traffic shifting without changing every application. If you have a handful of services, start with plain Kubernetes and add a mesh later.
Sidecar mode adds a proxy container to every pod. Ambient mode removes the sidecars: a small agent on each node handles mTLS, and optional waypoint proxies handle advanced routing. Ambient uses less memory per pod and avoids restarting pods to join the mesh.
No. They work at different layers. Network policies filter traffic at the network level, while a mesh adds identity, encryption, and request-level rules. Many platforms use both.
Linkerd has fewer concepts and a smaller feature set, which makes it simpler to learn. Istio does more and is more widely used, but takes longer to learn. Check each project's current release and support model before you decide.