Data Plane Proxy
also called Envoy, Sidecar Proxy
The per-workload proxy that actually carries mesh traffic, applying mTLS, retries, timeouts, routing and telemetry outside the application.
The mesh's control plane distributes configuration; the data plane proxy does the work. Every request in and out of a workload passes through it, which is what makes uniform policy possible without application changes.
What it supplies: mTLS termination and origination, per-route retries and timeouts, circuit breaking, load balancing (including zone-aware routing that keeps traffic local and cuts cross-zone cost), traffic splitting for canaries, and consistent per-hop metrics and traces.
What it costs: CPU and memory per workload, one to two milliseconds per hop, and a second thing to debug when a connection fails — "connection refused" becomes a question of identity, policy, certificate validity or trust bundle.
The ambient or sidecar-less mesh model, where a shared node-level proxy handles most traffic, exists specifically to reduce the per-pod overhead.