Comparison
East-west trafficvsService mesh
East-west traffic
one internal service calling another, which is most of your packets and historically none of your authentication.
Traffic between services inside the boundary. In a microservice estate it dwarfs the north-south volume, and it was traditionally unauthenticated and unencrypted on the assumption that the network was trusted. Making it verified — workload identity, mutual TLS, per-call policy — is precisely what a service mesh and a zero-trust posture are for, and it is why anything compromised inside the perimeter used to be able to reach everything.
Full entry →Service mesh
you get mutual TLS, retries and per-route traffic splitting without changing a line of application code, because a proxy sits next to each instance.
A layer of proxies deployed alongside services, handling routing, retries, mTLS and telemetry uniformly. It moves cross-cutting concerns out of each service's language and libraries. The cost is a substantial amount of operational machinery and a new class of failures that look like application bugs but live in the proxy.
Full entry →