Most service-mesh documentation starts with a Kubernetes cluster. The install guide assumes kubectl, the architecture diagrams show pods, and the troubleshooting section references CRDs. If you are running workloads on bare metal or plain Linux VMs, you are left to reverse-engineer what the Kubernetes-specific parts actually do and figure out the equivalent yourself. This article covers the practical differences.
Certificate rotation sounds straightforward until you think about what happens to in-flight connections during the switchover. A connection established with the old certificate is still open. The peer has validated the old certificate. If you revoke the old certificate the moment the new one is issued, that connection breaks. Zero-downtime rotation requires a period where both certificates are simultaneously valid. An overlap window. And some mechanism to ensure the new certificate has reached all peers before the old one expires.
The most common way teams break production with a service mesh is by applying an access policy that is subtly wrong. A rule that denies traffic it should allow, or allows traffic it should deny. The error is usually obvious in retrospect, but by the time it is obvious, something is down. Dry-run mode exists to catch these errors before they reach production.
A service mesh sits in the path of every service-to-service call in your system. That position makes it a natural place to collect observability data. But 'expose Prometheus metrics' covers a wide range. A mesh can expose dozens of counters that tell you very little, or a small set of metrics that answer the questions you actually have at 2 a.m. This article covers the metrics that matter and why.
SPIFFE stands for Secure Production Identity Framework for Everyone. The name is a mouthful, but the core idea is simple: instead of authenticating a service by its IP address or hostname, you authenticate it by a cryptographically verifiable identity document that is tied to the workload itself. This article explains what that means in practice.
Istio is the most widely deployed service mesh, and it is also the one teams most often want to leave. The reasons vary: control plane complexity, resource overhead, upgrade friction, or simply the desire to understand what is actually running in their infrastructure. Whatever the reason, the migration is tractable if you plan the steps in the right order.
The audit log is one of the more useful outputs of a service mesh, and also one of the more commonly ignored ones until a security team asks for it. Tuft Mesh Vault writes a structured JSON event for every policy change, certificate rotation, and routing update. Getting those events into a SIEM is straightforward, but the right approach depends on what your SIEM ingestion pipeline looks like.
The choice of Go for Tuft Mesh Vault was not a default. Martin Cottrell had written production systems in Python, Java, and Rust before starting this project. Go won on a specific set of criteria that matter for a piece of infrastructure software that operators need to deploy, debug, and trust on their own hardware.
Mesh infrastructure you provision and own. Write to us