Service Mesh Field Report

Service Mesh Field Report

Field notes from service mesh operations

Each report starts with a real situation from running Istio and Envoy, then shows the pattern behind it and what it means for platform and security leaders. All reports first appeared on LinkedIn, in German.

Reports
29
References
84
First report

Earlier reports

November 2026

  1. No. 28: Ambient or sidecar is not a matter of faith

    Four posts later and no further than before? So which is it, Ambient or sidecar? It depends. On what? The following grid with five rows helps.

    Date
    Topic
    Ambient
    Sources
    7

October 2026

  1. No. 27: The migration goes namespace by namespace, or not at all

    During the migration to Ambient, traffic can vanish from the dashboard without being gone. A staged plan with checkpoints catches that.

    Date
    Topic
    Ambient
    Sources
    8

  2. No. 26: Why I’m (still) staying with sidecars

    Ambient gets a lot right. For hard enterprise requirements, I’m staying with sidecars for now. The reason for that doesn’t show up in any benchmark.

    Date
    Topic
    Ambient
    Sources
    8

  3. No. 25: Two Components Share the Work of a Sidecar

    A policy that looked harmless in review cuts connections in Ambient that it was meant to allow. The reason lies one layer down.

    Date
    Topic
    Ambient
    Sources
    4

  4. No. 24: Ambient Solves an Operations Problem First

    A proxy update in the sidecar model means: every pod restarts, or someone stacks the maintenance windows of twenty teams on top of each other.

    Date
    Topic
    Ambient
    Sources
    4

  5. No. 23: Staging Lies

    The sign-off came from staging, green across the board. Three weeks later a path burns in production that staging never saw.

    Date
    Topic
    Staging parity
    Sources
    2

September 2026

  1. No. 22: What a Sidecar Costs, Only Those Who Measure Know

    “The sidecar costs us too much.” or “It is negligible.” Two sentences from almost every mesh debate. Hardly anyone has measured them.

    Date
    Topic
    Sidecar costs
    Sources
    3

  2. No. 21: Not Every Restart Is Free

    Sidecar upgrade sounds like infrastructure. For your pods it means: restart. For your clients it means: it depends.

    Date
    Topic
    Lifecycle
    Sources
    2

  3. No. 20: Two Control Planes Are Not a Luxury

    The most important question in a mesh upgrade is not how you move forward. It is how you get back when the first wave creaks.

    Date
    Topic
    Lifecycle
    Sources
    2

  4. No. 19: The Upgrade That Has Been Waiting for Three Versions

    In many backlogs there is a ticket that is about to celebrate a birthday. It is called ‘mesh upgrade’ and has been wandering from sprint to sprint for months.

    Date
    Topic
    Lifecycle
    Sources
    2

August 2026

  1. No. 18: Certificates Age Faster Than Runbooks

    The workload certificates in your mesh are short-lived and rotate automatically. For years, without anyone looking. That is exactly why nobody looks at the rest of the chain anymore either.

    Date
    Topic
    Certificates
    Sources
    3

  2. No. 17: A Gateway Is Not a Security Concept

    The egress topic has barely hit the table when the reflex kicks in: “We will build an egress gateway, then everything runs through one place.” It is often decided before anyone asks what it is actually supposed to enforce.

    Date
    Topic
    Egress gateway
    Sources
    2

  3. No. 16: The Mesh Calls Out, and Nobody Is Listening

    On the inside, your mesh is now Zero Trust: mTLS on STRICT, default on deny. And towards the outside? There it calls whoever it wants.

    Date
    Topic
    Egress
    Sources
    3

  4. No. 15: What Nobody Has Forbidden Is Allowed

    After the move to STRICT in the previous report, every connection in the mesh is encrypted and mutually authenticated. Sounds like mission accomplished. Except: every workload is still allowed to talk to every other one.

    Date
    Topic
    AuthorizationPolicy
    Sources
    3

July 2026

  1. No. 14: The Switch Nobody Wants to Flip First

    “mTLS is enabled”, says the team. When asked, it turns out the mesh default has been on PERMISSIVE since the rollout. That is not enabled. That is a maybe.

    Date
    Topic
    mTLS
    Sources
    3

  2. No. 13: Ten Weeks to Get Off App Mesh

    On September 30, AWS turns off App Mesh. That’s no longer a deprecation warning. It’s a shutdown date.

    Date
    Topic
    Migration
    Sources
    6

  3. No. 12: Four Questions, and You Can Read Any Envoy Mesh

    Almost every mesh runs the same engine. Today I take it apart. Don’t fear the depth, there are exactly four parts.

    Date
    Topic
    Envoy
    Sources
    3

  4. No. 11: Almost Every Mesh Runs the Same Engine

    Istio, Kuma, Consul, App Mesh, Gloo. Five names, and under the hood the same proxy five times: Envoy.

    Date
    Topic
    Mesh comparison
    Sources
    10

  5. No. 10: The Real Problem Was Never Istio

    Ten Field Reports. Almost all of them had the same root cause. And it was never in Istio.

    Date
    Topic
    Milestone

June 2026

  1. No. 9: Observability that actually helps in an incident

    During an incident, most people open Grafana first. Everything green. That’s exactly where the team gets stuck.

    Date
    Topic
    Observability
    Sources
    2

  2. No. 8: The Diagnostic Path Every Team Gets

    Two teams last week: one guesses for three hours, one is done in twenty minutes. The difference isn’t talent. It’s this one path.

    Date
    Topic
    Debugging

  3. No. 7: The scariest error message usually has the most mundane cause

    Most mesh incidents aren’t hard. They just look that way.

    Date
    Topic
    Debugging

  4. No. 6: Allow locally, prevent mesh-wide

    Closing the gap without taking away tenant autonomy.

    Date
    Topic
    Multi-tenancy

May 2026

  1. No. 5: When One Tenant Hijacks Everyone Else’s Traffic

    Letting tenants create their own VirtualServices opens a door to MITM inside your own mesh.

    Date
    Topic
    Multi-tenancy
    Sources
    1

  2. No. 4: Whoever Owns the Mesh Decides What Stays

    From Soltau, live at CloudLand: who’s actually responsible in the mesh?

    Date
    Topic
    Ownership

  3. No. 3: What Nobody Understands Anymore, but Everyone Still Uses

    20, 100, 500+ configuration objects - and no one dares to delete a thing.

    Date
    Topic
    Config lifecycle

  4. No. 2: When the CVE Lands, It’s Too Late

    Istio ships a minor release every three months. Sounds predictable.

    Date
    Topic
    Lifecycle

April 2026

  1. No. 1: When “Secure” Is Just a Gut Feeling

    mTLS enabled everywhere, dashboards green - and nobody can say what actually runs encrypted.

    Date
    Topic
    Accountability

About the author

Portrait of Uli Renz

Uli Renz has been building and hardening service meshes in highly regulated enterprise environments since Istio 1.4. The patterns in these reports come from that work.

If your mesh already runs in production, the Posture Check is the place to start: 13 review areas, each finding rated by severity and backed by evidence from the config. In 90 minutes we go through the list together.

Request a strategy call

The request form on istio-consulting.de is in German.