Sidecar
Envoy or Linkerd proxy runs alongside app. Intercepts inbound + outbound traffic. Application unaware.
Advertisement
mTLS
All service-service encrypted. Certs auto-rotated. Identity-based auth (SPIFFE/SPIRE). Zero-trust networking.
Advertisement
Traffic policies
Retries, timeouts, circuit breakers, canary routing. Configured in control plane. Data plane enforces.