Azure Service Mesh Architecture
A service mesh on Azure logically separates its operations into a Control Plane for management and a Data Plane for traffic handling, all running within an AKS cluster.
Control Plane
The management center of the mesh. It provides a unified API for operators, distributes policies to proxies, and aggregates telemetry for analysis in services like Azure Monitor, but never touches the service request packets themselves.
Data Plane
Composed of lightweight sidecar proxies (e.g., Envoy) deployed alongside each service instance in an AKS pod. These proxies intercept all network traffic to enforce security policies, manage traffic flow, and collect metrics.
Key Functionalities
Implementing a mesh unlocks powerful capabilities that are deeply integrated with the Azure ecosystem.
🚦 Traffic Management
Route traffic with precision. This chart shows a canary deployment where 5% of traffic is sent to a new service version for safe testing.
📈 Observability with Azure Monitor
Gain deep insights into your application's health. The mesh automatically sends metrics to Azure Monitor and traces to Application Insights.
🛡️ Zero-Trust Security
Enforce strong security policies, including automatic mTLS encryption and identity management with Azure Active Directory (AAD).
Service-to-service communication is encrypted and authenticated.
💪 Automated Resiliency
Improve fault tolerance. The mesh can automatically retry failed requests or trip a circuit breaker to prevent cascading failures.