The Brain and the Muscles
A service mesh has two distinct layers that must be understood separately before the whole system makes sense.
The Data Plane is the collection of all the sidecar proxies running alongside your application pods. These proxies do the actual work: they intercept packets, apply routing rules, encrypt traffic, and emit metrics. They are the "muscles" of the mesh. On their own, however, they are inert — they need to be told what to do.
The Control Plane is the centralized management component (in Istio, this is a single binary called istiod) that acts as the "brain." It:
- Watches the Kubernetes API for changes to services, pods, and mesh configuration objects.
- Translates that information into proxy configuration.
- Pushes that configuration down to every Envoy sidecar in real time.
- Acts as a Certificate Authority (CA), issuing and rotating the mTLS certificates that proxies use to identify themselves.
The separation matters because it means you can update routing rules or security policies without touching your application code or restarting any proxies. The control plane pushes the new config; the data plane applies it within seconds.