Service Mesh Use Cases: CCA practice questions

A service mesh moves cross-cutting networking concerns out of application code and into the platform. The Cilium documentation groups these concerns into five capabilities: resilient connectivity across clouds, clusters and premises; L7-aware traffic management such as load balancing, rate limiting and resiliency for HTTP, gRPC or WebSocket; identity-based security, where both sides authenticate each other by identity rather than by network address; observability and tracing; and transparency, meaning applications get all of this without code changes.

Cilium delivers these with two layers. Everything at the IP, TCP and UDP level is handled by eBPF in the kernel, while application protocols such as HTTP, gRPC and DNS are parsed by Envoy running once per node. That split shapes the practical use cases.

North-south traffic management is the most familiar one: Ingress and Gateway API resources expose applications, terminate TLS and split traffic by weight for canary or A/B releases. East-west traffic management, between workloads inside the cluster, is covered by GAMMA. An HTTPRoute or GRPCRoute binds to a Service as its parent instead of a Gateway, and Cilium steers traffic for that Service through the node-local Envoy. Cilium implements only producer routes, so such a route must live in the namespace of the Service it manages.

For cases that Gateway API cannot express, Cilium exposes Envoy configuration directly through the CiliumEnvoyConfig and CiliumClusterwideEnvoyConfig custom resources. The documented examples include path translation, URL rewriting, circuit breaking and traffic shifting. These resources receive only minimal validation and have no conflict resolution, so the documentation asks that they be treated as cluster admin objects. If only this Envoy-level traffic management is wanted, the enable-envoy-config option can be set without turning on the Ingress controller, and loadBalancer.l7.backend=envoy enables Envoy-based load balancing for ordinary Kubernetes Services.

Identity-based security is the use case behind mutual authentication. When it is enabled, a CiliumNetworkPolicy rule can carry an authentication block with mode required; the agent then performs a mutual TLS handshake with the peer node, using SPIFFE identities issued through SPIRE, before the policy lets traffic through. Pairing it with WireGuard or IPsec adds encryption of the traffic itself.

Observability rounds out the picture. Because Envoy streams its access logs to the agent, Hubble can show HTTP methods, paths and status codes for traffic covered by L7 rules, next to the L3 and L4 flows that eBPF records.