Chapter 33: Service Mesh — Istio, Envoy, and gRPC

What a Service Mesh Does for gRPC

• mTLS: automatic encryption between all services (zero code changes)
• L7 load balancing: per-RPC balancing (not per-connection)
• Retries/timeouts: configured in mesh, not in application code
• Observability: automatic metrics, traces, access logs
• Traffic management: canary deployments, A/B testing, fault injection

Envoy as gRPC Proxy

Envoy natively understands gRPC (HTTP/2 + trailers). It can:

• Route by gRPC service/method name
• Retry specific status codes
• Rate limit per method
• Transcode gRPC ↔ REST (gRPC-JSON transcoding)

Istio + gRPC

# VirtualService for gRPC traffic splitting:
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
spec:
  http:
  - match:
    - headers:
        content-type: {exact: "application/grpc"}
    route:
    - destination: {host: my-service, subset: v2}
      weight: 10
    - destination: {host: my-service, subset: v1}
      weight: 90

Mark as Complete