Designing a Service Mesh for Global Scale At SAP
summary
SAP aims to deliver a multi-cluster Service Mesh as a Service for 40,000 engineers and over 10,000 clusters, built as a mesh of meshes (project Atom) that stitches Envoy/Istio proxies, API gateways and PKI into a global fabric. Key specifics: mTLS enforced for service-to-service traffic, offline root CA + intermediate CAs for scale, SPIRE federation for cross-mesh identity, OPA/external auth for fine‑grained policies, and designs to avoid egress hairpins and central bottlenecks.
AI-written summary · about
chapters (15)
- 0:00Intro
- 0:39About SAP
- 1:56Business Technology Platforms
- 2:31Currently Using Service Mesh
- 4:08SuccessFactors
- 6:17Business Technology Platform
- 7:12Security
- 9:46PKI Infrastructure
- 10:28Why Use Service Mesh
- 11:15Service Mesh Architecture
- 11:36Atom
- 13:07Building Blocks
- 13:55Multiple Layers
- 15:31Traffic
- 16:43Conclusion
related talks
05mBest Practices on Setting up Multi Cluster Service Mesh in AWS
10mService Mesh Security in a Nutshell
26mService Mesh Journey - Building Security and Reliability One Si...
40mReimagining Application Networking and Security
33mSolving Multi-Service Without a Service Mesh
45mSo you think you can mesh? Scaling ING's service mesh
45mMulti-Runtime Service Mesh With Consul
53mDo you need a Service Mesh?