3 ms·
The only other reason I can think of to use a service mesh is if you want to restrict which services can talk to each other. That's easier to do when centrally
by lstamour 6y ago
The only other reason I can think of to use a service mesh is if you want to restrict which services can talk to each other. That's easier to do when centrally deployed via proxy configuration, though the building blocks are the same as what Kubernetes provides out of the box, so you could do that on your own. If you investigate that far, though, you're not installing service meshes due to hype, you're analyzing service meshes as a form of application architecture. Instead of deploying dependencies using language-specific tooling, you can deploy dependencies using Kubernetes and the network, with some overhead of course, and a lot of configuration-as-code. Parallels to "You don't need no service mesh" could also be drawn for things like the OpenTelemetry Collector or maybe projects like OpenPolicyAgent, or "Identity-Aware Proxies" and other cloud services -- including Kubernetes itself. In the end, all of these tools are generic enough that you can use them in many ways to save time -- but you don't have to, as this article points out, and it might not actually save you any time at all if your environment is small enough.
- jeffbee 6y agoIf you think a proxy can constrain communications between two services, I suggest that is not correct. How does it prevent the two services from speaking out of band? It is a fundamental tenet in computer security that access controls be enforced at the endpoints. It's not any harder to distribute ACLs to your endpoints than it is to distribute the same ACLs to a fleet of proxy processes.
- lstamour 6y agoThat would be a configuration change: https://istio.io/latest/docs/tasks/traffic-management/egress/egress-control/ https://istio.io/latest/docs/tasks/traffic-management/egress... My apologies, though I said Envoy, I meant within an Istio or Istio-like deployment on K8S where the networking layer is already managed by Kubernetes. https://istio.io/latest/docs/setup/additional-setup/cni/ https://istio.io/latest/docs/setup/additional-setup/cni/