Beyond the Magic
To most users, a Service Mesh like Istio or Linkerd is just "magic." You add a label to a namespace, and suddenly you have mutual TLS (mTLS), metrics, and canary deployments. It feels like the platform is reading your mind.
But under the hood, there is no magic. There is only Envoy Proxy.
Envoy is a high-performance C++ proxy designed to mediate all inbound and outbound traffic for every service in the mesh. It is deployed as a sidecar — meaning it runs alongside your application container in the same Kubernetes Pod, sharing the same network namespace. Every byte your application sends or receives passes through Envoy first.
The mesh is split into two planes. The data plane is the collection of all Envoy sidecars — they do the actual work of forwarding, encrypting, and observing traffic. The control plane (Istio's istiod, for example) is the brain that pushes configuration to those sidecars. The control plane never touches production traffic; it only tells the data plane what to do.
Understanding how Envoy processes packets and how it gets injected into your Pods is the difference between a "Mesh User" and a "Mesh Architect." When something breaks — and it will — you need to know exactly where to look.