# service-mesh Published articles for service-mesh. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## 【Istio 控制面】控制面全景：从 CRD 到 xDS 的翻译与推送内核 DevFeed: [【Istio 控制面】控制面全景：从 CRD 到 xDS 的翻译与推送内核]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-08-11T00:00:00Z Content type: article Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [istio](), [Architecture & Design]() Tags: [ambient](), [control-plane](), [gateway-api](), [istio](), [istiod](), [k8s](), [kubernetes](), [network](), [pilot](), [service-mesh](), [sidecar](), [xds]() ### AI overview This first article in a 16-part series maps the Istio control plane's role between configuration inputs and proxy-side xDS consumption. It defines five analytical axes and uses Istio 1.30.3 as its version anchor, while outlining the series' scope and boundaries. ### Source excerpt 定位 Istio 控制面内核相对 Envoy 消费侧、Service Mesh 税文与 Gateway API 资源模型的缺口；给出五条坐标系、16 篇地图与本系列明确不写的范围，钉住 istiod 1.30.3 为主线。 ## Service Mesh Architecture: Sidecar Overhead, Istio, and Alternatives Without Sidecars DevFeed: [Service Mesh Architecture: Sidecar Overhead, Istio, and Alternatives Without Sidecars]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-04-13T00:00:00Z Content type: article Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Architecture & Design](), [istio](), [Kubernetes](), [Cilium](), [eBPF](), [linkerd]() Tags: [architecture](), [cilium](), [ebpf](), [envoy](), [istio](), [kubernetes](), [linkerd](), [observability](), [proxy](), [security](), [service-mesh](), [sidecar](), [tls]() ### AI overview This article explains the core problems addressed by service meshes and examines the Sidecar architecture, including traffic interception, proxy processing, Envoy's xDS configuration model, and Istio's istiod control plane. It focuses on the performance and operational overhead of Sidecars and compares them with approaches such as Cilium's eBPF-based implementation and Istio Ambient Mesh. ### Source excerpt 2023 年，某头部电商平台在全量接入 Istio 后发现：每个 Pod 的内存占用增加了 40-70 MB，p99 延迟从 12 ms 上升到 18 ms，整个集群每月多出数万美元的计算成本。这并非个例。CNCF 2024 年度调查显示，超过 60% 的受访企业已在生产环境中使用或评估服务网格（Service Mes... ## Kubernetes 网络深度系列 DevFeed: [Kubernetes 网络深度系列]() Original publisher: [Read original article]() Author: Liao Tonglang Published: 2026-04-03T00:00:00Z Content type: tutorial Language: zh Sources: [土法炼钢 - 系统与基础设施]() Topics: [Kubernetes](), [Linux](), [eBPF](), [VXLAN](), [gateway](), [nginx](), [traefik](), [Grafana]() Tags: [ebpf](), [gateway](), [grafana](), [index](), [k8s](), [kubernetes](), [linux](), [net-11](), [networking](), [nginx](), [return](), [series](), [service-mesh](), [traefik](), [vxlan]() ### AI overview A Chinese tutorial series explains Kubernetes networking from the Linux network stack through virtual devices, routing, tunnels, eBPF, CNI plugins, Services, security policies, service discovery, traffic management, performance tuning, and troubleshooting. It includes packet captures, code, and kernel-source references, with comparisons of major CNI and ingress approaches. ### Source excerpt 从 Linux 网络栈的第一个字节到多集群联邦网络的最后一跳----用代码、抓包和内核源码把 Kubernetes 网络讲透 ## How to Secure Microservices with SPIFFE and Istio DevFeed: [How to Secure Microservices with SPIFFE and Istio]() Original publisher: [Read original article]() Author: info@goteleport.com (Jeff Ellin, Boris Kurktchiev) Published: 2026-02-20T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [istio](), [Microservices](), [SPIFFE](), [Zero Trust](), [Authorization](), [Architecture & Design](), [Secrets Management](), [certificates]() Tags: [architecture](), [authorization](), [backend](), [certificates](), [cloud-native](), [firewalls](), [how-to](), [istio](), [kubernetes](), [microservices](), [policies](), [secrets-management](), [security](), [service-mesh](), [spiffe](), [zero-trust]() ### AI overview This guide explains how to secure microservices with SPIFFE identities, Istio service-mesh mTLS, short-lived certificates, and Zero Trust authorization policies. It addresses the limits of network-based trust and long-lived certificates in dynamic Kubernetes environments. ### Source excerpt Learn how to deploy a secure microservices application, configure default-deny authorization policies, and rebuild service connectivity with SPIFFE-based allow rules. ## Securing Salesforce Integrations with Heroku AppLink DevFeed: [Securing Salesforce Integrations with Heroku AppLink]() Original publisher: [Read original article]() Author: David Baliles Published: 2025-09-10T15:00:41Z Content type: article Language: en Sources: [Heroku]() Topics: [Heroku](), [Security](), [Authentication](), [OAuth](), [Architecture & Design](), [SDKs]() Tags: [apis](), [applink](), [authentication](), [credentials](), [development](), [engineering](), [heroku](), [integrations](), [oauth](), [salesforce](), [security](), [service-mesh](), [tokens](), [trust](), [validation](), [visibility]() ### AI overview This post explains how Heroku AppLink secures Salesforce integrations through a managed bridge, service mesh, authentication, service discovery, request validation, and short-lived credentials. It describes how AppLink can replace exposed endpoints and stored credentials while supporting integrations deployed in different languages. ### Source excerpt Salesforce customers often leverage third-party or custom services to extend their orgs, and they do so with two common options: Connected Apps and External Services. Connected Apps let third-party vendors or custom code call Salesforce APIs using long-lived OAuth tokens, while External Services call vendor APIs through declarative configurations with vendor-managed hosting, scaling, and endpoint security. While both approaches deliver functionality, the dynamic security threat landscape challenges us to continuously improve the risk and governance of our applications. Heroku AppLink improves your security model and provides a managed bridge between Salesforce and Heroku, so developers or vendors can deploy services in any language and expose them as native Salesforce actions. Heroku AppLink automatically handles authentication, service discovery, and request validation while its service mesh and short-lived credentials mean that your integrations no longer depend on stored credentials or exposed endpoints. Development teams can reuse existing code and libraries instead of rewriting in Apex, admins get centralized visibility into connections and authorizations, and security teams gain tighter trust boundaries across both Connected App and External Service scenarios. The post Securing Salesforce Integrations with Heroku AppLink appeared first on Heroku. ## How we Integrated SPIFFE, Oauth2.0 and Spring Boot DevFeed: [How we Integrated SPIFFE, Oauth2.0 and Spring Boot]() Original publisher: [Read original article]() Author: Matthew Benedict Stocks Published: 2022-12-14T09:36:48Z Content type: tutorial Language: en Sources: [Wise Engineering - Medium]() Topics: [SPIFFE](), [Authorization](), [OpenID connect (OIDC)](), [SPIRE](), [Library](), [Security](), [Spring Boot]() Tags: [authorization](), [cybersecurity](), [library](), [oauth2](), [platform](), [security](), [service-mesh](), [spiffe](), [spring-boot]() ### AI overview Wise's Security Engineering team describes how it consolidated SPIFFE/SPIRE and OIDC authorization strategies into the wise-security shared library. The approach reduces Spring Security boilerplate, presents a consistent service-layer security context, and adds guardrails intended to reduce misconfiguration and authorization complexity. ### Source excerpt How we Integrated SPIFFE, OAuth2 and Spring Boot At Wise the Security Engineering team supports the Security Squad by developing tools and building technical controls relevant to the security maturity of existing technological setup. We work closely with teams across Platform and Product to help improve our overall security posture and reduce the friction encountered when engineering new software at speed. Photo by Jason Dent on UnsplashThe problem As a company we have a goal of reducing the amount of time it takes to go from inception to creation with our services. We want teams across Wise to be able to focus on the challenges encountered in their domain, rather than cross-cutting concerns, such as how to secure their endpoints. At Wise our approach was to create a common shared library, allowing teams to share our security solution while still retaining their autonomy. Standard security setups such as those seen with Spring Security often require a lot of boilerplate code (even if provided as part of a service template) which we wanted to reduce and where possible, abstract it entirely. Along with improving the quality of life for new and experienced engineers within Wise, this also helps to prevent any misconfiguration that could eventually lead to a vulnerability. Another challenge which arose was to offer a security context that appears the same at the service layer, but can be created from any of the protocols used by our systems, as well as being extensible if necessary. We needed to allow developers to control access to services with minimal effort, alongside creating a security guardrail for exposed endpoints to ensure services have been configured correctly. Introducing Wise Security At Wise, our service mesh layer is handled by Envoy and the identity framework for secure communication between mesh nodes is SPIFFE/SPIRE. User based IAM is handled via the OIDC authorization protocol. Each authorization approach must be enforced at the service layer, but du ## RPC 漫谈： 连接问题 DevFeed: [RPC 漫谈： 连接问题]() Original publisher: [Read original article]() Author: Joway Published: 2021-05-06T00:00:00Z Content type: tutorial Language: zh Sources: [Random Thoughts]() Topics: [Remote Procedure Call (RPC)](), [Linux](), [IO](), [Server]() Tags: [io](), [linux](), [rpc](), [server](), [service-mesh](), [tcp](), [tech]() ### AI overview This article explains what a network connection represents, the memory, file-descriptor, and thread costs of maintaining connections, and why the C10K problem is primarily an operating-system and software-design challenge. It then introduces the evolution of Linux I/O interfaces, including select and poll, in the context of RPC and large numbers of concurrent connections. ### Source excerpt 什么是连接 在物理世界并不存在连接这么一说，数据转换为光/电信号后，从一台机器发往另一台机器，中间设备通过信号解析出目的信息来确定如何转发包。我们日常所谓的「连接」纯粹是一个人为抽象的概念，目的是将传输进来的无状态数据通过某个固定字段作为标识，分类为不同有状态会话，从而方便在传输层去实现一些依赖状态的事情。 ## RPC 漫谈：序列化问题 DevFeed: [RPC 漫谈：序列化问题]() Original publisher: [Read original article]() Author: Joway Published: 2021-04-30T00:00:00Z Content type: tutorial Language: zh Sources: [Random Thoughts]() Topics: [Remote Procedure Call (RPC)](), [Code](), [interface](), [class](), [Java]() Tags: [class](), [client](), [code](), [interface](), [java](), [protobuf](), [remote-procedure-calls](), [rpc](), [service-mesh](), [tech]() ### AI overview This article explains RPC serialization and deserialization, including IDL definitions, generated Stub code, reflection, and encoding techniques such as Varint and ZigZag. It discusses trade-offs between generated code size, convenience, performance, and network payload size. ### Source excerpt 何为序列 对于计算机而言，一切数据皆为二进制序列。但编程人员为了以人类可读可控的形式处理这些二进制数据，于是发明了数据类型和结构的概念，数据类型用以标注一段二进制数据的解析方式，数据结构用以标注多段(连续/不连续)二进制数据的组织方式。 例如以下程序结构体： ## RPC 漫谈： 限流问题 DevFeed: [RPC 漫谈： 限流问题]() Original publisher: [Read original article]() Author: Joway Published: 2021-04-23T00:00:00Z Content type: opinion Language: zh Sources: [Random Thoughts]() Topics: [Remote Procedure Call (RPC)](), [Server](), [client](), [IO](), [Network](), [cpu]() Tags: [client](), [cpu](), [io](), [network](), [rpc](), [server](), [service-mesh](), [tech]() ### AI overview This article examines rate limiting for RPC calls between microservices. It explains why fixed limits can help prevent cascading failures and preserve response times, then discusses the limitations of leaky-bucket and token-bucket approaches. The article argues that service capacity changes with code, dependencies, hardware, node count, business demand, and time of day. It proposes estimating current load using concurrent in-flight requests, average response time, and throughput, drawing on Little's law, and describes the trade-off between increased throughput and degraded response time under resource contention. ### Source excerpt 微服务之间的 RPC 调用往往会使用到限流功能，但是很多时候我们都是用很简单的限流策略，亦或是工程师拍脑袋定一个限流值。 这篇文章主要讨论在 RPC 限流中，当前存在的问题和可能的解决思路。 为什么需要限流 避免连锁崩溃 一个服务即便进行过压测，但当真实运行到线上时，其收到的请求流量以及能够负载的流量是不固定的，如果服务自身没有一个自我保护机制，当流量超过预计的负载后，会将这部分负载传递给该服务的下游，造成连锁反应甚至雪崩。 ## The Road to an Envoy Service Mesh DevFeed: [The Road to an Envoy Service Mesh]() Original publisher: [Read original article]() Author: Snow Pettersen Published: 2019-03-29T15:36:51Z Content type: article Language: en Sources: [Square Corner Blog - Medium]() Topics: [microservices architecture](), [Architecture & Design](), [interoperability](), [Remote Procedure Call (RPC)](), [Go Language](), [Java](), [Ruby](), [Ruby on Rails](), [gRPC](), [Code]() Tags: [architecture](), [automatic](), [discovery](), [engineering](), [envoy-proxy](), [failover](), [go](), [http](), [interoperability](), [java](), [microservices](), [microservices-architecture](), [routing](), [rpc](), [ruby](), [service-mesh]() ### AI overview Square describes its evolution from a Ruby on Rails monolith to a microservices architecture and explains the interoperability challenges created by its Java, Ruby, and Go stack. The article outlines its Protobuf-based Sake RPC framework, its routing, failover, traffic-shaping, and service-discovery features, and Square's migration toward a full service mesh. ### Source excerpt Heads up, we've moved! If you'd like to continue keeping up with the latest technical content from Square please visit us at our new home https://developer.squareup.com/blog At Square we've been running a microservices architecture for years, primarily using three different languages: Java, Ruby and Go. Running such a diverse stack can make interoperability between the different languages/frameworks challenging, and in this post I'll talk about how Square has handled this in the past and where we're at today -- actively migrating towards a full service mesh. The Old World Square started off, like many other companies, just running one large monolith. For Square this was a big Ruby on Rails service, that handled everything that Square did. A monolith makes service to service communication completely unnecessary: everything runs in the same code base on a single database, so everything can be implemented without making any outbound network calls (except to third parties outside of Square). After a while, Square decided to move more towards a service oriented architecture to reduce the reliance on a single, large application. To do this Square decided to build their own Protobuf based RPC framework, inspired by Google's Stubby. This was years before gRPC was created, so there weren't any open source options at the time. This RPC framework, called Sake, was implemented for Java and Go as these were the languages used for higher availability services, while regular REST HTTP was used between services that didn't understand Sake. (Incidentally, Sake became a part of gRPC's DNA) Over time this framework became fairly sophisticated, with many features not generally available: Smart retries with automatic failover Prioritized routing based on upstream health Traffic shaping and service discovery This ended up working well, but relied on fat client/server libraries, so extending support to other languages was hard. Attempts were made to bring feature parity between languages i ## Keycloak and Istio DevFeed: [Keycloak and Istio]() Original publisher: [Read original article]() Author: Sébastien Blanc Published: 2018-02-26T00:00:00Z Content type: tutorial Language: en Sources: [Keycloak Blog]() Topics: [istio](), [Keycloak](), [JSON Web Tokens](), [Architecture & Design](), [proxy]() Tags: [envoy-proxy](), [http](), [idm](), [istio](), [jwt](), [kerberos](), [keycloak](), [ldap](), [load-balancing](), [openid-connect](), [proxy](), [saml](), [service-mesh](), [sso]() ### AI overview This short blog post describes early trials of combining Keycloak with Istio. It explains how Istio's Envoy sidecar and JWT authentication filter can take over some security tasks traditionally handled by Keycloak adapters, while noting that the replacement is not yet complete. ### Source excerpt This short blog post is to share the first trials of combining Keycloak with Istio. What is Istio? Istio is an platform that provides a common way to manage your service mesh. You may wonder what a service mesh is, well, it's an infrastructure layer dedicated to connect, secure and make reliable your different services. Istio, in the end, will be replacing all of our circuit-breakers, intelligent load balancing or metrics librairies, but also the way how two services will communicate in a secure way. And this is of course the interesting part for Keycloak. As you know Keycloak uses adapters for each of the application or service that it secures. These adapters make sure to perform the redirect if needed, to retrieve the public keys, to verify the JWT signature etc ... There are a lot of different adapters depending on the type of application or technology that is used : there are Java EE adapters, JavaScript adapters and we even have a NodeJS adapter. The end of the adapters? Following the Istio philosophy, these adapters would not be needed in the end because the Istio infrastructure will take care of the tasks the adapters were doing (signature verification etc ...). We are not yet there for now but in this post we will see what can already be done with Istio and how much it already can replace the role of the Adapters. The Envoy Sidecar We won't dive into the details on how Istio works but there is one main concept to understand around which Istio is articulated : the Envoy Sidecar. Envoy is a high performance proxy deployed alongside with each deployed service and this is the reason we call it a "sidecar". Envoy captures all incoming and outgoing traffic of its "companion" service, it can then apply some basic operations and also collect data and send it to a central point of decision, called the "mixer" in Istio. The conifugration of Envoy itself happens through the "pilot" an other Istio component. Envoy Filters To make it easier to add new functionnality to t