Service Mesh Field Report #13
Ten Weeks to Get Off App Mesh
This is an English translation. The report was first published in German. Read the German original
On September 30, AWS turns off App Mesh. That’s no longer a deprecation warning. It’s a shutdown date.
Before anyone touches YAML, the honest question about the destination. If you’re ECS-native, go with Service Connect: that’s the official AWS path and the right answer for that case. If you run on EKS, connect multiple clusters, or have hard mTLS and policy requirements, you need a real mesh. That case is what the rest of this report is about, and the destination is Istio.
The good news from the last two weeks: both systems run the same engine. A Virtual Node becomes a Deployment with sidecar injection. Virtual Router and Routes become a VirtualService, match rules and traffic split included. The subsets end up in the DestinationRule. The Virtual Gateway becomes an Istio Gateway. One trap up front: App Mesh’s Virtual Service and Istio’s VirtualService share the name, not the role. The full table is in the image.
And because Envoy works underneath both, there’s an acceptance test better than any gut feeling: the config_dump. Same listeners, same routes, same clusters before and after, and the move was correct. The four questions from report #12 are your test protocol.
The scaffold for it: inventory, which App Mesh objects actually exist. Parallel operation, run Istio alongside it rather than underneath it. Then migrate workload by workload and compare the telemetry, you know istio_requests_total from report #9. At the end, teardown, with proof instead of hope.
Where it hurts: retry and timeout defaults are not identical. The match semantics of the Routes don’t translate one-to-one. Egress behaves differently once REGISTRY_ONLY enters the picture. These are the places where a weekend project turns into a quarter.
The scaffold is the generic part, that one is on me. The specific part is your setup. If the countdown affects you and you want a target state or a second pair of eyes on the mapping: reach out, a DM is enough.
In July, this is a project. In September, it’s an emergency.
From the field, for the field
Every report is built on patterns from real mesh setups. If one of them sounds like your cluster, an architecture call is the place to look at it together.
Request an architecture call