Service Mesh Is Still Hard. The Things we all Did Wrong & Tales of Woe
summary
Linkerd migrates from a JVM/Finagle stack to a Go control plane and adds zero config onboarding via namespace annotations, automatic sidecar injection, a built-in CA that enables mutual TLS on by default with 24‑hour rotation, and bundled observability (Prometheus/Grafana) plus a linkerd check command. Istio surfaces concrete gotchas: TCP gateways reject host matches (workaround: TLS; Envoy host bug fixed in 1.7), pre‑1.6 health checks break with mTLS unless annotated, and header‑based routing often requires code changes to propagate headers.
AI-written summary · about
chapters (23)
- 0:00Intro
- 0:49Speaker Introduction
- 1:36The service mesh tradeoff
- 2:55This is a talk about complexity
- 4:52Who pays the complexity cost?
- 6:13Lots of Linkerd examples
- 6:54Example: meshing a pod
- 7:50Example: routing traffic
- 8:19Example: mutual TLS
- 9:03Example: mesh health
- 11:02Concepts are not obvious
- 11:57Maintain Boundary
- 12:42TCP and Hosts
- 13:40When You Find A Bug
- 15:10Health checks
- 16:07Services uses https
- 17:42Do you need service mesh?
- 18:17Need Mesh Analyzer
- 18:56Zero configuration is possible
- 19:24Zero code change is not!
- 20:31How is my application doing?
- 20:50How is my mesh doing?
- 21:26Conclusion
related talks
44mService Mesh - The New Single Point of Failure
45mService Mesh War Stories - Lessons Learned the Hard Way
33mService Meshes: Istio, Linkerd - or No Mesh at All?
35mNavigating the Service Mesh Ecosystem
27mService Mess to Service Mesh
34mService Mess to Service Mesh
52mService Mess to Service Mesh
37mIntro: Linkerd