Sidecar & Ambassador
Cross-cutting behaviour in a co-deployed process.
3 to work through
-
beginner Multiple choice
A platform team rolls out sidecar proxies so every service gets mTLS without code changes. A month later an auditor captures traffic and finds one service still sending plaintext credentials to an external payments SaaS. The sidecar is running and healthy. Why is that traffic not encrypted by the mesh?
3 min answer -
intermediate
A platform is considering a sidecar to provide mTLS, retries and telemetry without changing application code. What does that buy and what does it cost?
2 min answer -
advanced
A platform moves cross-cutting concerns into a sidecar process alongside every service. What does this solve, and what new problems appear?
2 min answer
3 terms in this topic
Ambassador Pattern
A helper process that handles outbound network communication on behalf of an application, adding retries, routing, security and telemetry without cha…
conceptSidecar Interception Boundary
The precise set of traffic a sidecar proxy actually sees and can secure, which is narrower than "all traffic from this pod" and is what decides wheth…
conceptSidecar Resource Overhead
The cumulative CPU, memory and latency cost of running helper containers alongside every application container.
Neighbouring topics
Architecture Patterns
General material on architectural patterns and their trade-offs.
Layered Architecture
The default shape, its clarity, and where a technical partition fails.
Event-Driven Architecture
Publishing facts, and trading comprehensibility for decoupling.
Pipes and Filters
Independent transformation steps composed into a pipeline.
Publish/Subscribe
Broadcast to every subscriber, as distinct from work distribution.
Competing Consumers
Scaling throughput with instances, at the cost of ordering.
Saga
Local transactions with compensating actions across services.
CQRS
Separate models for writing and reading, each optimised for its job.
Event Sourcing
The event log as the system of record, with state as a projection.
Outbox
Making the event atomic with the business write it describes.
Strangler Fig
Incremental replacement behind a routing facade.
Anti-Corruption Layer
Translating a foreign model at the boundary so it does not leak in.
Service Mesh
Sidecars applied estate-wide, and the scale at which that pays.
API Gateway
A single entry point for policy, routing and protocol translation.
Backend for Frontend
A narrow backend per client experience, owned by that client's team.
Cell-Based Architecture
Complete isolated copies each serving a subset of customers.
Sharding Patterns
Directory versus embedded keys, logical shards and rebalancing.
Materialized Views
Precomputed query results, refreshed incrementally or in full.
Orchestration vs Choreography
A coordinator that knows the flow, or services that react to events.