Service Mesh Platform  ·  View 10 of 31  ·  3 · Structure

Integration Surface

Every interface the platform exposes or consumes, grouped by whether it changes the mesh or is served by it.

Editable source SVG draw.io All views
What changes it Intent repos · Argo CD Argo Rollouts Kubernetes API Platform Service Mesh Platform compile · issue · enforce What it serves and reaches Workloads · peer clusters Telemetry stores OpenBao · root ceremony GitOps apply weight steps watch mTLS · xDS OTLP CA renewal Integration Surface — Every Interface Data store Application we own Security / platform External / third party synchronous event / async Only mTLS between proxies is on a request path. External APIs sit behind the egress gateway on view 29. v 1.0 · owner Platform Networking Architecture · date 2026-09

Decisions

  • There is no mesh API of our own. Intent enters through Git and the Kubernetes API, weights through Argo Rollouts, and every consumer speaks a standard: xDS, SPIFFE, OTLP.
  • Weight steps enter through the rollout controller and nowhere else. The integration surface for a release is one Kubernetes object, not a script that edits routes.

Contracts

  • Workloads: mTLS with SPIFFE identities, trace-context and deadline headers forwarded by the application.
  • Telemetry: OTLP from node collectors, with a bounded buffer and a published drop counter.
  • PKI: SPIRE's UpstreamAuthority plugin calling OpenBao's PKI mount for that cluster only.

Deliberately out

  • A self-service portal. Teams already review changes in Git, and a portal would become a second path to production with a weaker review.
◀  Trust Hierarchy All views Anatomy of One Meshed Call  ▶
Solution Architecture v1.0 · Platform Networking Architecture · 2026-09 · 31 views · open source, fully on-premises10-integration-surface