#33Build a Service Mesh (Envoy / Istio style)
Every microservice request crosses two proxies. This curriculum is what they do: routing, load balancing, timeout-and-retry-budget, circuit breakers, outlier detection, token-bucket rate limits, mTLS with workload identity, and a control plane that streams config to all of them. Build it in the order the production problems show up — and feel why Envoy plus a control plane has eaten the east-west world.

You have written a Flask, Express, or Spring service. You have called another service over HTTP. You have used curl -v and watched the TLS handshake happen. That is your starting point. By the end of this curriculum you will be able to design a service-mesh deployment — pick sidecar vs edge proxy, route on path or header, set timeout / retry budget / circuit breaker / outlier detection thresholds for a concrete workload, choose mTLS posture, decide local vs global rate limit, and predict what happens when the control plane dies — and defend each choice with a named scene.

This curriculum is the working developer's guide to the piece of infrastructure every microservice request passes through, in the order the production problems show up. It is also a curriculum about a specific, density-of-vocabulary realization: across 13 scenes there are roughly 28 named technical terms, and each scene introduces at most two. The visual carries the load; the vocabulary follows.

Resist the urge to "describe Envoy" or "describe Istio." Make decisions yourself, defend them, and let the design push back. Every knob you can name on the design canvas is a knob you can defend in a production review.

Reading: Envoy proxy docs — Architecture overview, Listeners, Clusters, Outlier detection, Circuit breaking, Rate limiting, xDS protocol (envoyproxy.io/docs/envoy/latest) · Istio docs — Architecture, Traffic management, Security, Observability, Ambient mesh (istio.io/latest/docs) · Matt Klein — Announcing Envoy (Lyft Engineering, 2016) · Nygard — Release It! 2e — circuit breakers and bulkheads (Pragmatic Bookshelf) · Marc Brooker — Timeouts, retries, backoff with jitter (AWS Builders' Library) · W3C Trace Context — Level 2 (w3.org/TR/trace-context/) · SPIFFE & SPIRE concepts (spiffe.io/docs/latest/spiffe-about/spiffe-concepts/) · Linkerd — Why we don't use Envoy (linkerd.io/2020/12/03/why-linkerd-doesnt-use-envoy/) · Cilium / eBPF Service Mesh and Istio Ambient mode for sidecar-less designs
the 50-services problem: heterogeneous policy → cascading outage
sidecar pattern; data plane vs control plane
L4 vs L7 proxying (which sees path/headers, which doesn't)
listener + ordered route table; canary by header or weight
cluster as group-of-replicas; load-balancing policies (round-robin / least-request / ring-hash)
timeout, per-try timeout, exponential backoff with jitter
retry budget — the fix for retry storms (≤3% Envoy default)
circuit breaker — closed / open / half-open
outlier detection (passive eject) vs active health check
token-bucket rate limiting; local (cheap, drifts) vs global (exact, RPC hop)
mTLS, SPIFFE-style workload identity, short-lived certs
control plane vs data plane; xDS (LDS / RDS / CDS / EDS / SDS) streaming
trace + span; W3C traceparent propagation; sampling vs RED metrics
design canvas: pick posture per workload (latency-critical, ingress, batch, partner)