Skip to content

Service Mesh¶

A service mesh provides infrastructure-level features like mutual TLS (mTLS), traffic management, and observability without changing application code. This guide covers integrating Cello with Istio and Envoy.

What a Service Mesh Provides¶

Feature Description
mTLS Automatic encryption between all services
Service Discovery Services find each other by name
Traffic Management Canary deployments, A/B testing, circuit breaking
Observability Distributed tracing, metrics, and access logs
Retries & Timeouts Automatic retry policies at the mesh level

Istio Integration¶

Installing Istio¶

istioctl install --set profile=demo
kubectl label namespace default istio-injection=enabled

When Istio injection is enabled, a sidecar proxy (Envoy) is automatically added to every pod in the namespace. No changes to your Cello application are needed.

Deployment with Istio¶

Deploy Cello normally. The Istio sidecar intercepts all traffic:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: cello-app
  labels:
    app: cello-app
    version: v1
spec:
  replicas: 3
  template:
    metadata:
      labels:
        app: cello-app
        version: v1
    spec:
      containers:
        - name: app
          image: cello-app:latest
          ports:
            - containerPort: 8000

Mutual TLS (mTLS)¶

Istio provides automatic mTLS between services. Enable strict mTLS:

apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
spec:
  mtls:
    mode: STRICT

With strict mTLS, all service-to-service communication is encrypted without any application-level TLS configuration.

Traffic Management¶

Virtual Service (Routing)¶

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: cello-app
spec:
  hosts:
    - cello-app
  http:
    - route:
        - destination:
            host: cello-app
            subset: v1
          weight: 90
        - destination:
            host: cello-app
            subset: v2
          weight: 10

This sends 90% of traffic to v1 and 10% to v2 (canary deployment).

Destination Rule¶

apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: cello-app
spec:
  host: cello-app
  trafficPolicy:
    connectionPool:
      tcp:
        maxConnections: 100
      http:
        h2UpgradePolicy: DEFAULT
        maxRequestsPerConnection: 100
    outlierDetection:
      consecutive5xxErrors: 5
      interval: 30s
      baseEjectionTime: 30s
  subsets:
    - name: v1
      labels:
        version: v1
    - name: v2
      labels:
        version: v2

Circuit Breaking at the Mesh Level¶

The mesh provides circuit breaking independently of Cello's built-in circuit breaker:

trafficPolicy:
  outlierDetection:
    consecutive5xxErrors: 5
    interval: 30s
    baseEjectionTime: 60s
    maxEjectionPercent: 50

Tip

Use Cello's circuit breaker for application-level protection and the mesh circuit breaker for infrastructure-level protection. They complement each other.

Observability¶

Istio automatically collects:

  • Metrics via Envoy sidecar (request count, latency, error rate)
  • Distributed traces via trace context propagation
  • Access logs for every request

View the service graph in Kiali:

istioctl dashboard kiali

Retry Policies¶

Configure automatic retries at the mesh level:

apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: cello-app
spec:
  hosts:
    - cello-app
  http:
    - retries:
        attempts: 3
        perTryTimeout: 2s
        retryOn: "5xx,reset,connect-failure"
      route:
        - destination:
            host: cello-app

Timeouts¶

http:
  - timeout: 10s
    route:
      - destination:
          host: cello-app

Cello + Service Mesh Best Practices¶

Concern Recommendation
TLS Use mesh mTLS instead of Cello's TlsConfig for internal traffic
Health Checks Keep Cello health endpoints; probes bypass the sidecar
Metrics Use both Cello Prometheus and mesh metrics for full visibility
Tracing Propagate traceparent headers through your handlers
Circuit Breaking Use both layers for defense in depth

Next Steps¶