Service Mesh Platform · View 07 of 31 · 3 · Structure
Decisions
- The identity plane is its own layer and does not share a process with the control plane. istiod compiles configuration and holds no signing key; SPIRE issues identities and knows nothing about routes.
- Cilium sits in the data plane as a second enforcement point. It is weaker than the mesh (L3/L4, no identity from certificates) and it is independent of it, which is the property an emergency block needs.
- Argo CD runs one instance per site, so no site's clusters need another site's control loop to change.
Why this shape lasts
- The seams between layers are open standards: Kubernetes objects, xDS, the SPIFFE Workload API and OTLP. A layer's implementation can change without the layers either side of it noticing.
Deliberately out
- A service catalogue product. Dependencies are declared in the intent repositories next to routes, because a declaration that lives in a different system from the configuration it drives drifts from it.
