Choosing the Right Envoy Load Balancing Policy for Upstream Clusters
A technical guide on selecting the optimal Envoy load balancing policy, comparing Round Robin, Least Request, and Consistent Hashing to optimize backend performance.
Loading…
ReadMeFeed / Community knowledge
#service-mesh
Real questions. Useful conversations. Find the people who know your stack.
Traefik Mesh Gateway mTLS Without Sidecars Across Clusters
Traefik Mesh uses gateway proxies and automated mTLS to secure multi-cluster service traffic without per-pod sidecars, with routing controlled via TrafficRoute CRDs.
traefikmesh
kubernetesTraefik Mesh mTLS Certificate Rotation and Secret Synchronization
Traefik Mesh implements a zero-trust architecture by utilizing a central Certificate Authority (CA) to distribute identities to sidecar proxies via Kubernetes secrets. This mechanism ensures that mutual TLS (mTLS) is enforced for all inter-service communication based on SPIFFE-like identity standards. A critical requirement for maintaining mesh security is t
Traefik Mesh control plane and data plane version matching limits
Evaluation of Traefik Mesh for new Kubernetes workloads that require automatic mTLS, traffic routing and observability is constrained by documented coupling between components and product support status. Traefik Mesh is built around a control plane and data plane that are intended to be used as a matched set. Mesh features such as traffic splitting, canary r
Traefik Mesh ACL mode transition for internal service isolation
Traefik Mesh implements a permissive default posture where services are reachable by any other meshed workload upon joining the mesh. To prevent accidental internal exposure, the mesh provides an ACL mode based on the Service Mesh Interface (SMI) TrafficTarget specification. When transitioning from a permissive setup to a restrictive one, the primary goal is