Service Mesh (Istio / Linkerd)

Service mesh adds L7 policy via sidecar proxies (Envoy in Istio, Linkerd proxy). Features: mutual TLS between services, retries/timeouts, circuit breaking, traffic splitting (canary), and automatic metrics/traces without app code changes.

# Istio — mTLS strict for payment namespace
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: payments
spec:
  mtls:
    mode: STRICT

# Canary deployment — 90/10 split
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: payment-gateway
spec:
  http:
    - route:
        - destination:
            host: payment-gateway
            subset: v1
          weight: 90
        - destination:
            host: payment-gateway
            subset: v2
          weight: 10