Service Mesh Platform  ·  View 27 of 31  ·  6 · Operations

Roadmap

What each phase makes true, in the order that keeps the mesh inside its budget and the fleet reversible.

Editable source SVG draw.io All views
MVP · one site SPIRE identity · 24 h Permissive → strict In-proxy authz · dry-run 1% weights · revert Timeouts · retries · ejection Namespace scoping Clusters on one network Phase 2 · three sites Dependency scoping · delta Config waves · auto halt East-west gateways Controlled egress Retry budgets · shedding Revision upgrades Phase 3 · cost and depth Per-node L4 for no-L7 External authz opt-in Cross-site spillover SLO-burn rollback Root rotation rehearsal Policy replay at scale Roadmap — What Each Phase Makes True Security / platform Application we own Interface / broker Opportunity Coarse scoping ships with the MVP. Unscoped, every proxy carries the whole mesh and its memory grows with the fleet instead of with the workload. v 1.0 · owner Platform Networking Architecture · date 2026-09

Sequencing decisions

  • Identity and permissive mTLS come first, because every later capability, from authorisation to cross-cluster trust, reads the peer identity.
  • Coarse configuration scoping (own namespace plus declared namespaces) ships with the MVP. Dependency-level scoping stays in Phase 2 as the requirement sets it.
  • The per-node L4 layer waits for Phase 3 and for measurements. It adds a second data-plane component and a node-sized blast radius, and it should buy a saving that has been measured, not estimated.

Exit criteria

  • MVP: 12,000 proxies inside the resource budget, a 12-hour control-plane outage drill passed, strict mode on the first ten services.
  • Phase 2: a cluster lost in a drill with no change elsewhere; a bad config caught by wave 0.
  • Phase 3: a root rotation rehearsed end to end on staging.

Risks

  • Retry budgets arrive in Phase 2 but timeouts arrive in the MVP. Until then, attempt counts are held at two to limit amplification.
◀  Mesh Cost Budget All views Progressive Delivery Cycle  ▶
Solution Architecture v1.0 · Platform Networking Architecture · 2026-09 · 31 views · open source, fully on-premises27-roadmap