Glossary · 2 · Developer SDKs and APIs
Service mesh
Also known as: Service-mesh architecture
In distributed software architecture, a service mesh is a dedicated infrastructure layer that handles service-to-service communication through proxies, deployed as sidecars next to each service or as shared node-level proxies, and provides traffic management, mutual TLS, retries, timeouts and telemetry without changes to application code.
- Developer SDKs
- SDK interoperation
In one sentence
A service mesh handles traffic between services through proxies, adding mutual TLS, retries, timeouts and telemetry outside the application code.
Example
After a mesh is introduced, the order service no longer configures retries and TLS in its HTTP client library; the mesh proxies encrypt the traffic and retry failed calls according to central policy.
How it applies
- What moves out of the SDK: In a microservice architecture, retries, timeouts, encryption, service discovery and traffic metrics used to be implemented in each service's client libraries. A mesh moves them into the infrastructure, so they behave the same for every language. Client SDKs become thinner, but their documentation has to say which of these features they still perform, to avoid double retries or conflicting timeouts.
- Data plane and control plane: Proxies form the data plane and carry the traffic; a control plane distributes configuration, certificates and policies to them. Istio offers two data plane modes: sidecar proxies and an ambient mode with shared proxies.
- Security: Meshes typically issue workload identities and encrypt traffic with mutual TLS. They support authentication and authorization policies between services; the policies still have to be designed and reviewed.
- Observability: Proxies emit metrics, logs and trace spans for every call, which supports observability and distributed tracing. End-to-end traces still require the application to propagate trace context, for example with OpenTelemetry.
- Gateways: An API gateway handles traffic entering the system from outside; a mesh handles traffic between services inside it. Many deployments use both.
Service mesh vs. client library
A client library is code inside the application process and can use knowledge of the API (pagination, typed errors, idempotency keys). A mesh proxy works at the network level, knows protocols but not business semantics, and applies the same rules to every service. Retries that depend on whether an operation is idempotent are therefore better decided where that knowledge exists.
Background
Istio and Linkerd are graduated projects of the Cloud Native Computing Foundation (Linkerd since July 28, 2021, Istio since July 12, 2023, as of October 11, 2026).