A dedicated infrastructure layer — built from a Sidecar next to every service — handling service-to-service traffic, security, and observability uniformly.
Adding a Sidecar to one service handles that service's outbound TLS, retries, and metrics. Across dozens or hundreds of services, each configured independently, drift creeps in — inconsistent retry policies, uneven mTLS coverage, and no unified view of how traffic flows across the whole fleet.
Every service instance gets a sidecar proxy (the data plane) that all its network traffic passes through. A central control plane configures every proxy consistently — routing rules, retry policy, mTLS certificates — so behavior is uniform across the fleet and observable from one place.
Every service's outbound call passes through the same `MeshProxy` logic — retries and logging are consistent across the whole fleet by construction, not by convention.
// A minimal stand-in for what a sidecar proxy does for every service in a mesh.
class MeshProxy {
constructor(policy) { this.policy = policy; }
async call(serviceName, fn) {
for (let attempt = 0; attempt <= this.policy.retries; attempt++) {
try {
console.log(`mesh: [mTLS] calling ${serviceName} (attempt ${attempt + 1})`);
return await fn();
} catch (err) {
if (attempt === this.policy.retries) throw err;
}
}
}
}
// Control plane pushes the same policy to every proxy in the fleet.
const meshPolicy = { retries: 2 };
const proxyA = new MeshProxy(meshPolicy);
const proxyB = new MeshProxy(meshPolicy);
await proxyA.call("billing-service", async () => "charged");
await proxyB.call("inventory-service", async () => "reserved");
// Every service gets identical retry/mTLS behavior without configuring it itself.