Istio Fundamentals

Split an application into a fleet of microservices and you inherit a second application nobody asked to build: the network between them. Every service now needs retries, timeouts, encryption, identity, access control, and telemetry for its calls to every other service. Traditionally that logic gets written into each service, in whatever language it happens to use, and re-verified every time it changes. Istio moves that logic out of application code and into the infrastructure layer, so services get traffic management, security, and observability without touching their own source.

The mental model: every service gets a proxy that handles its network traffic, and a central control plane programs every proxy from one set of rules. The proxies are the data plane; the brain that configures them is the control plane. You describe intent — split traffic 90/10 between two versions, require encrypted connections, allow only these callers — and Istio compiles that intent into proxy configuration and pushes it out.

Why a service mesh, and why now

Service meshes exist because the "put it in a shared library" answer to cross-cutting network concerns breaks down at scale. A shared library still means every team recompiles and redeploys when the networking logic changes, and it still means every language runtime needs its own implementation. Moving that logic into a sidecar proxy next to each service makes it language-agnostic and centrally upgradable: change a routing rule or a security policy once, and it applies mesh-wide without touching application code or triggering a redeploy.