A service mesh moves the hard parts of service-to-service networking - encryption, retries, timeouts, traffic shifting and telemetry - out of your application code and into the platform. Istio is the most widely used mesh on Kubernetes, and when it’s adopted deliberately it removes a lot of bespoke plumbing. Adopted all at once, it can also add a layer of complexity your team isn’t ready to debug.

This post covers what Istio gives you, the features worth turning on first, and the gotchas we’ve hit running it in production.

This talk by Dawid Ziolkowski at DevOpsDays Warsaw is a clear introduction to Istio. If you’ve heard of service meshes but never quite grasped what problems they solve, it’s a good place to start - it covers what a mesh gives you (traffic management, observability and mutual TLS between services) and how Istio implements it on top of Kubernetes.