Service Mesh Platform  ·  View 01 of 31  ·  1 · Context and scope

System Context

The traffic the mesh carries, the people who change its behaviour, and the platform and authorities it depends on without owning.

Editable source SVG draw.io All views
Traffic it carries Meshed workloads 2,000 services North-south ingress edge gateways People who change what it does Service team Release engineer Security engineer Mesh SRE What it stands on and reaches Kubernetes clusters scheduling · endpoints Offline root CA HSM · ceremony External APIs declared egress only Delivery pipeline CI · image builds Service Mesh Platform 20 clusters · 40k proxies Records and reporting Git service intent repositories Team cost owners monthly report east-west calls admitted routes · dependencies rollouts · revert authz · identity upgrades · drift pods · endpoints signs intermediates controlled egress rollout intent declared intent mesh cost Service Mesh Platform — System Context External / third party Person or role Security / platform synchronous batch v 1.0 · owner Platform Networking Architecture · date 2026-09

Decisions

  • The mesh owns the east-west path only. North-south ingress is a caller: it hands the mesh admitted traffic, and the mesh treats the edge gateway as one more workload with its own identity.
  • Kubernetes is drawn outside. The mesh reads pods and endpoints and never schedules anything, so a scheduling incident and a mesh incident have different owners and different runbooks.
  • The root CA is an authority the mesh visits once a year, not a service it calls. It is offline, and nothing on this page can reach it over a network.

Assumptions

  • Three data centres, 20 clusters, 600 services and 12,000 proxies at launch, rising to 2,000 services and 40,000 proxies. All figures are the requirement's stated assumptions.
  • The requirement names AWS. This design runs the same problem on hardware the organisation owns with open-source software only; section-by-section mappings are in the README.

Deliberately out

  • Workload scheduling, the north-south edge, application-level user authentication and service-to-database traffic that does not pass through a sidecar.
All views High-Level Architecture  ▶
Solution Architecture v1.0 · Platform Networking Architecture · 2026-09 · 31 views · open source, fully on-premises01-system-context