Nobody Knows Who Called catalog
What a service mesh actually is, what Kubernetes quietly leaves undone between your services — and the honest case for not installing one yet.
Istio from Scratch
A service mesh without sidecars — ambient mode, ztunnel, waypoints, and mTLS you did not have to ask for, on Istio 1.30.
-
-
A Proxy in Every Pod Is a Restart in Every Pod
Sidecars and ambient — the honest comparison, why this book bets on the newer one, and the failure that will confuse you most if you follow a sidecar tutorial in an ambient mesh.
-
The Mesh That Changed Nothing
Pinning Istio 1.30.2, installing the ambient profile, and touring the three things it lands — none of which have touched your application yet, and one of which starts a six-month clock.
-
Six Pods, Zero Restarts, One Label
Enrolling a namespace into an ambient mesh is a single kubectl label. The pods do not restart, do not gain a container, and do not notice — and the sidecar model structurally cannot do that.
-
The mTLS You Didn't Ask For, and the Identity You Didn't Have
HBONE, SPIFFE, a 24-hour certificate, and the discovery that every service in the bookshop had exactly the same identity — which made mutual TLS a secure channel between two things we could not tell apart.
-
ztunnel Cannot Send You a 403
The node proxy that carries every packet in an ambient mesh — what it enforces, why its denials arrive as a connection reset rather than an HTTP status, and the hard ceiling it hits the moment you ask it about a URL.
-
Your Waypoint Says None, and It Is Working Perfectly
A waypoint is an Envoy you deploy on purpose, and it binds to Services — not to pods. The per-pod table will tell you it isn't there. It is.
-
The Front Door That Reports Failure and Serves Every Request
An Istio Gateway is the Gateway API you already know, with an Envoy behind it that belongs to the mesh — and on kind it will tell you, forever, that it is not programmed. It is.
-
A Canary That Counts Requests, Not Pods
Two implementations, the same 90/10 split, and neither one delivered 90/10 — plus the reason a mesh beats a rolling update at canarying, which is not the syntax.
-
Ready, Running, and Serving Nothing but 500s
Timeouts, retries and outlier detection in ambient — including the Gateway API field that does not exist, and the one thing a mesh does that Kubernetes structurally cannot.
-
The Policy Said ALLOW. The DELETE Went Through.
The same AuthorizationPolicy, the same caller, and the only variable is whether a waypoint is in the path — because an L7 rule with nothing to enforce it is not a stricter policy, it is an unenforced one, and it fails open.
-
Nobody Instrumented the Bookshop
One Prometheus query returns the record of every experiment in this book — the fault injection, the timeout, the denials — from an application that has never contained a single line of monitoring code.