Service Mesh

Service mesh provides intelligent service-to-service communication. Learn to implement and manage service mesh for microservices architectures.

Challenge

Implement a service mesh that provides observability, security, and traffic management across microservices without changing application code.

Explanation

Service Mesh Benefits

Observability: Distributed tracing, metrics
Security: mTLS, authorization policies
Traffic Management: Routing, load balancing
Resilience: Retries, timeouts, circuit breakers
Service Discovery: Dynamic service registry

Popular Service Meshes

Istio: Most feature-rich
Linkerd: Lightweight, Rust-based
Consul Connect: HashiCorp’s mesh
Kuma: Kong’s service mesh
Open Service Mesh: CNCF incubating

Code Examples

1. Istio Configuration

apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    istio-injection: enabled

---

# istio/virtual-service.yaml
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: user-service
  namespace: production
spec:
  hosts:
  - user-service
  http:
  - match:
    - uri:
        prefix: /api/v1
    route:
    - destination:
        host: user-service
        port:
          number: 3000
        subset: v1
      weight: 90
    - destination:
        host: user-service
        port:
          number: 3000
        subset: v2
      weight: 10
    timeout: 10s
    retries:
      attempts: 3
      perTryTimeout: 2s

---

# istio/destination-rule.yaml
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: user-service
  namespace: production
spec:
  host: user-service
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        http1MaxPendingRequests: 100
        http2MaxRequests: 100
    loadBalancer:
      simple: ROUND_ROBIN
    outlierDetection:
      consecutive5xxErrors: 5
      interval: 30s
      baseEjectionTime: 30s
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2

---

# istio/gateway.yaml
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: api-gateway
  namespace: production
spec:
  selector:
    istio: ingressgateway
  servers:
  - port:
      number: 443
      name: https
      protocol: HTTPS
    tls:
      mode: SIMPLE
      credentialName: tls-secret
    hosts:
    - "api.example.com"
  - port:
      number: 80
      name: http
      protocol: HTTP
    hosts:
    - "api.example.com"

2. Traffic Management

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: order-service
spec:
  hosts:
  - order-service
  http:
  - match:
    - headers:
        user-type:
          exact: premium
    route:
    - destination:
        host: order-service
        port:
          number: 3000
        subset: premium
    timeout: 5s
  - route:
    - destination:
        host: order-service
        port:
          number: 3000
        subset: standard
    timeout: 10s
    retries:
      attempts: 3
      perTryTimeout: 2s

---

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: order-service
spec:
  host: order-service
  trafficPolicy:
    loadBalancer:
      consistentHash:
        httpCookie:
          name: session
          ttl: 3600s
  subsets:
  - name: premium
    labels:
      tier: premium
  - name: standard
    labels:
      tier: standard

3. Security Policies

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT

---

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: api-policy
  namespace: production
spec:
  selector:
    matchLabels:
      app: api
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/production/sa/web-app"]
    to:
    - operation:
        methods: ["GET"]
        paths: ["/api/public/*"]
  - from:
    - source:
        principals: ["cluster.local/ns/production/sa/admin"]
    to:
    - operation:
        methods: ["*"]
        paths: ["/api/admin/*"]

---

# Deny all by default
apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: default-deny
  namespace: production
spec:
  {}

4. Observability Configuration

apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: custom-metrics
  namespace: production
spec:
  metrics:
  - providers:
    - name: prometheus
    overrides:
    - match:
        GLOBAL: {}
      dimensions:
      - request_host
      - request_path
      - request_method
      - response_code

---

apiVersion: telemetry.istio.io/v1alpha1
kind: Telemetry
metadata:
  name: tracing-config
  namespace: production
spec:
  tracing:
  - providers:
    - name: jaeger
      host: jaeger-collector
      port: 14250
    randomSamplingPercentage: 100.0
    useRequestIdForTraceid: true

5. Service Mesh Implementation in Node.js

// Health metrics for service mesh
app.get('/stats', (req, res) => {
  res.json({
    name: 'user-service',
    version: 'v1',
    uptime: process.uptime(),
    requests: {
      total: requestCount,
      errors: errorCount,
      success: requestCount - errorCount,
    },
  });
});

// Circuit breaker for service calls
class ServiceMeshClient {
  constructor(serviceName, port = 3000) {
    this.serviceName = serviceName;
    this.port = port;
    this.circuitBreaker = new CircuitBreaker(this.call.bind(this));
  }

  async request(path, options = {}) {
    return this.circuitBreaker.execute(path, options);
  }

  async call(path, options) {
    const url = `http://${this.serviceName}:${this.port}${path}`;

    const response = await fetch(url, {
      timeout: options.timeout || 5000,
      ...options,
    });

    if (!response.ok) {
      throw new Error(`Service error: ${response.status}`);
    }

    return response.json();
  }
}

// Usage in endpoints
const userServiceClient = new ServiceMeshClient('user-service', 3001);

app.get('/api/orders', async (req, res) => {
  try {
    const users = await userServiceClient.request('/api/users');
    const orders = await database.orders.find();

    res.json({
      orders,
      userCount: users.length,
    });
  } catch (error) {
    res.status(503).json({ error: 'Service temporarily unavailable' });
  }
});

6. Monitoring with Kiali

# Install Kiali for Istio visualization
kubectl apply -f https://raw.githubusercontent.com/istio/istio/release-1.17/samples/addons/kiali.yaml

# Port forward to access Kiali
kubectl port-forward -n istio-system svc/kiali 20000:20000

# Access at http://localhost:20000

Best Practices

Implementation
- Use sidecar proxies
- Enable mutual TLS
- Configure traffic policies
- Monitor from start
Security
- Implement RBAC
- Enforce mTLS
- Use authorization policies
- Regular updates
Observability
- Collect metrics
- Distributed tracing
- Service visualization
- Alert on anomalies
Performance
- Optimize proxy resources
- Monitor latency impact
- Tune connection pools
- Load test
Operations
- Gradual rollout
- Monitor adoption
- Document policies
- Train team

Real-World Applications

Microservices: Service communication
Multi-Team: Traffic isolation
Compliance: mTLS enforcement
Observability: Distributed tracing
Gradual Migration: Canary deployments