Service Mesh
An infrastructure layer of sidecar proxies that handles service-to-service networking — mTLS, retries, timeouts, routing, telemetry — outside the application.
The argument is that every service otherwise reimplements the same networking concerns in its own language, inconsistently, and upgrading them means asking every team to bump a library. Moving them into a proxy makes the policy uniform and lets the platform team ship changes without touching applications.
What you actually get: mTLS between every workload without application changes, consistent retry, timeout and circuit-breaker policy, traffic splitting for canaries, and per-hop telemetry for free.
What it costs: a proxy per pod (CPU, memory, and one to two milliseconds per hop), a control plane that is now critical infrastructure, certificate lifecycle as an outage mode, and debugging that requires understanding both your service and the mesh. Below roughly twenty services, a library or a gateway usually delivers more of the value for far less operational surface.