Service Mesh Platform  ·  View 13 of 31  ·  4 · Data

Intent and Evidence — Data Model

The entities that declared intent, identity and observed state share, and the one join that makes drift a query instead of a guess.

Editable source SVG draw.io All views
intent_version commit_sha PK repo routes|security|identity author signed_by bundle_digest merged_at change_record change_id PK commit_sha FK actor before_digest after_digest applied_at per cluster service service_id PK namespace owner_team mtls_mode permissive|strict sampling_rate subset subset_id PK service_id FK selector version, region backing_service dependency caller_id FK -> service callee_id FK -> service declared_in FK -> intent_version route route_id PK service_id FK match header, path, method timeout_ms NOT NULL retry_on, attempts commit_sha FK route_backend route_id FK subset_id FK weight 0-100 mirror_percent authz_policy policy_id PK service_id FK action allow|deny mode enforce|dry_run principals commit_sha FK workload_identity spiffe_id PK trust_domain cluster namespace service_account issuance_record serial PK spiffe_id FK node_attestation workload_selectors issuer_ca not_before, not_after proxy_status proxy_id PK spiffe_id FK commit_sha FK effective xds_nonce, acked_at proxy_version 1 : N 1 : N 1 : N 1 : N N : M 1 : N 1 : N 1 : N Intent and Evidence — Data Model proxy_status.commit_sha is observed, route.commit_sha is intended; drift is the rows where they differ. v 1.0 · owner Platform Networking Architecture · date 2026-09

Decisions

  • Every intended object carries the commit sha that produced it, and every proxy reports the sha of the configuration it has acknowledged. Drift is a join, not an investigation.
  • A route with no timeout cannot exist: timeout_ms is not nullable in the schema, and admission refuses the object before istiod sees it.
  • Subsets are separate Kubernetes Services selected by version label, not DestinationRule subsets. That is what the Gateway API's weighted backends expect, and it keeps the routing intent portable.

Where each entity lives

  • intent_version, route, authz_policy, dependency: Git, then Kubernetes objects. issuance_record: ClickHouse. proxy_status: Prometheus series from the drift exporter. change_record: Git history plus the Kubernetes audit log, copied to Object Lock storage.

Deliberately out

  • A relational database of mesh configuration. The model is logical; no single system holds all of it, and forcing it into one would create a system of record that lags the real ones.
◀  Five Stores, Five Recovery Obligations All views Configuration Distribution Pipeline  ▶
Solution Architecture v1.0 · Platform Networking Architecture · 2026-09 · 31 views · open source, fully on-premises13-intent-data-model