Field notes from service mesh operations

Service Mesh Field Report

The series archive

Every week, one report from running Istio and Envoy in the enterprise: a real situation, the pattern behind it, and what it means for the people responsible. Written by Uli Renz, OMNI52. All reports first appeared on LinkedIn, in German.

  1. Four Questions, and You Can Read Any Envoy Mesh

    Almost every mesh runs the same engine. Today I take it apart. Don't fear the depth, there are exactly four parts.
  2. Almost Every Mesh Runs the Same Engine

    Istio, Kuma, Consul, App Mesh, Gloo. Five names, and under the hood the same proxy five times: Envoy.
  3. The Real Problem Was Never Istio

    Ten Field Reports. Almost all of them had the same root cause. And it was never in Istio.
  4. Observability that actually helps in an incident

    During an incident, most people open Grafana first. Everything green. That's exactly where the team gets stuck.
  5. The Diagnostic Path Every Team Gets

    Two teams last week: one guesses for three hours, one is done in twenty minutes. The difference isn't talent. It's this one path.
  6. The scariest error message usually has the most mundane cause

    Most mesh incidents aren't hard. They just look that way.
  7. Allow locally, prevent mesh-wide

    Closing the gap without taking away tenant autonomy.
  8. When One Tenant Hijacks Everyone Else's Traffic

    Letting tenants create their own VirtualServices opens a door to MITM inside your own mesh.
  9. Whoever Owns the Mesh Decides What Stays

    From Soltau, live at CloudLand: who's actually responsible in the mesh?
  10. What Nobody Understands Anymore, but Everyone Still Uses

    20, 100, 500+ configuration objects - and no one dares to delete a thing.
  11. When the CVE Lands, It's Too Late

    Istio ships a minor release every three months. Sounds predictable.
  12. When "Secure" Is Just a Gut Feeling

    mTLS enabled everywhere, dashboards green - and nobody can say what actually runs encrypted.