kaz29Вестник Казахстанско-Британского технического университетаHerald of the Kazakh-British Technical University1998-66882959-8109Казахстанско-Британский Технический Университет10.55452/1998-6688-2026-23-2-276-289kaz29-2911Research ArticleКОМПЬЮТЕРНЫЕ НАУКИCOMPUTER SCIENCESERVICE MESH: АРХИТЕКТУРНЫЕ ПРИНЦИПЫ, ПРОИЗВОДИТЕЛЬНОСТЬ И ПРАКТИКА ПРИМЕНЕНИЯ В МИКРОСЕРВИСНЫХ СИСТЕМАХSERVICE MESH: ARCHITECTURAL PRINCIPLES, PERFORMANCE AND PRACTICAL USE IN MICROSERVICE SYSTEMShttps://orcid.org/0009-0008-6784-3842КемелбековН. К.KemelbekovN. K.

Докторант.

Алматы

doctoral student.

Almaty

kemellbekov@gmail.comhttps://orcid.org/0000-0003-1427-198XРахимоваД. Р.RakhimovaD. R.

PhD, ассоциированный профессор.

Алматы

Associate Professor, PhD.

Almaty

diana.rakhimova@kaznu.edu.kzhttps://orcid.org/0000-0002-1561-8255AdaliЕ.AdaliE.

Профессор-эмеритус.

Стамбул

Professor Emeritus.

Istanbul

adali@itu.edu.trКазахский национальный университет им. аль-ФарабиКазахстанAl-Farabi Kazakh National UniversityKazakhstanIstanbul Technical UniversityТурцияIstanbul Technical UniversityTurkey202627062026232276289Copyright © Кемелбеков Н.К., Рахимова Д.Р., Adali Е., 20262026Кемелбеков Н.К., Рахимова Д.Р., Adali Е.Kemelbekov N.K., Rakhimova D.R., Adali E.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://vestnik.kbtu.edu.kz/jour/article/view/2911

В работе рассматривается технология Service Mesh как выделенный инфраструктурный слой для управления межсервисным взаимодействием в микросервисных системах. Цель исследования – проанализировать архитектурные принципы построения сетевого слоя, оценить накладные расходы на производительность и показать практические подходы к эксплуатации в Kubernetes-кластерах. Описывается модель разделения на control plane и data plane, использование паттерна sidecar для прозрачной маршрутизации трафика, реализации mTLS и автоматического сбора телеметрии. На основе обзора литературы и открытой документации выполняется сравнительный анализ трех ключевых реализаций – Envoy, Istio и Linkerd – по функциональности, сложности внедрения и ресурсоемкости. Отдельно приводится практический пример конфигурации Istio с использованием манифестов Gateway, VirtualService и DestinationRule для управления HTTPS-трафиком и интеграции со стеком наблюдаемости Prometheus – Grafana – Jaeger – Kiali. Показано, что Service Mesh добавляет умеренные накладные расходы по задержке и потреблению ресурсов, однако обеспечивает унифицированное управление безопасностью и трафиком между микросервисами. Полученные результаты позволяют сформулировать практические рекомендации по целесообразности применения Service Mesh в корпоративных микросервисных платформах в зависимости от масштаба системы и требований к безопасности.

This paper examines service mesh technology as a dedicated infrastructure layer for managing interservice communication in microservice systems. The objective of the study is to analyze the architectural principles of network layer construction, estimate performance overhead, and demonstrate practical approaches for operationalization in Kubernetes clusters. It describes a model for separating the control plane and data plane, using the sidecar pattern for transparent traffic routing, implementing mTLS, and automatically collecting telemetry. Based on a literature review and open source documentation, a comparative analysis of three key implementations – Envoy, Istio, and Linkerd – is provided based on functionality, implementation complexity, and resource consumption. A practical example of an Istio configuration is provided, using Gateway, VirtualService, and DestinationRule manifests to manage HTTPS traffic and integrate with the Prometheus – Grafana – Jaeger – Kiali observability stack. It was shown that Service Mesh adds moderate overhead in terms of latency and resource consumption, but provides unified management of security and traffic between microservices. The obtained results allow us to formulate practical recommendations on the feasibility of using Service Mesh in enterprise microservice platforms, depending on the system scale and security requirements.

Service MeshмикросервисыKubernetesIstioEnvoyLinkerdmTLSнаблюдаемостьраспределенные системыService MeshmicroservicesKubernetesIstioEnvoyLinkerdmTLSobservabilitydistributed systemsИсследование выполнено без внешней финансовой поддержкиReferencesCloud Native Computing Foundation. CNCF Annual Survey 2023 (2023). URL: https://www.cncf.io/reports/cncf-annual-survey-2023/ (accessed: 02.03.2026).Cloud Native Computing Foundation. CNCF Annual Survey 2023 (2023). URL: https://www.cncf.io/reports/cncf-annual-survey-2023/ (accessed: 02.03.2026).Newman, S. Building Microservices: Designing Fine-Grained Systems, 2nd ed. (Sebastopol: O’Reilly Media, 2021), 615 p.Newman, S. Building Microservices: Designing Fine-Grained Systems, 2nd ed. (Sebastopol: O’Reilly Media, 2021), 615 p.Farkiani, B., Jain, R. Service Mesh: Architectures, Applications, and Implementations. arXiv preprint arXiv:2405.13333 (2024). URL: https://arxiv.org/abs/2405.13333 (accessed: 02.03. 2026).Farkiani, B., Jain, R. Service Mesh: Architectures, Applications, and Implementations. arXiv preprint arXiv:2405.13333 (2024). URL: https://arxiv.org/abs/2405.13333 (accessed: 02.03. 2026).Burns, B., Oppenheimer, D. Design Patterns for Container-based Distributed Systems. USENIX Workshop on Hot Topics in Cloud Computing (HotCloud ’16) (2016). URL: https://www.usenix.org/node/196347 (accessed 02.03. 2026).Burns, B., Oppenheimer, D. Design Patterns for Container-based Distributed Systems. USENIX Workshop on Hot Topics in Cloud Computing (HotCloud ’16) (2016). URL: https://www.usenix.org/node/196347 (accessed 02.03. 2026).Zhu, X., She, G., Xue, B., et al. Dissecting Overheads of Service Mesh Sidecars. Proceedings of the ACM Symposium on Cloud Computing (SoCC ’23), 142–157 (2023). https://doi.org/10.1145/3620678.3624652Zhu, X., She, G., Xue, B., et al. Dissecting Overheads of Service Mesh Sidecars. Proceedings of the ACM Symposium on Cloud Computing (SoCC ’23), 142–157 (2023). https://doi.org/10.1145/3620678.3624652Li, W., Lemieux, Y., Gao, J., Zhao, Z., and Han, Y. Service Mesh: Challenges, State of the Art, and Future Research Opportunities. Proceedings of the IEEE International Conference on Service-Oriented System Engineering (SOSE), 122–127 (2019). https://doi.org/10.1109/SOSE.2019.00026Li, W., Lemieux, Y., Gao, J., Zhao, Z., and Han, Y. Service Mesh: Challenges, State of the Art, and Future Research Opportunities. Proceedings of the IEEE International Conference on Service-Oriented System Engineering (SOSE), 122–127 (2019). https://doi.org/10.1109/SOSE.2019.00026Gregg, B. Systems Performance: Enterprise and the Cloud, 2nd ed. (Boston: Addison-Wesley Professional, 2020), 886 p.Gregg, B. Systems Performance: Enterprise and the Cloud, 2nd ed. (Boston: Addison-Wesley Professional, 2020), 886 p.Richardson, C. Microservices Patterns: With Examples in Java (Shelter Island: Manning Publications, 2018), 520 p.Richardson, C. Microservices Patterns: With Examples in Java (Shelter Island: Manning Publications, 2018), 520 p.Villamizar, M., Garcés, O., Castro, H., et al. Evaluating the Monolithic and the Microservice Architecture Pattern to Deploy Microservices on PaaS. Proceedings of the 12th Iberian Conference on Information Systems and Technologies (CISTI), 1–8 (2015). https://doi.org/10.1109/CISTI.2015.7170480Villamizar, M., Garcés, O., Castro, H., et al. Evaluating the Monolithic and the Microservice Architecture Pattern to Deploy Microservices on PaaS. Proceedings of the 12th Iberian Conference on Information Systems and Technologies (CISTI), 1–8 (2015). https://doi.org/10.1109/CISTI.2015.7170480Pahl, C., Brogi, A., Soldani, J., and Jamshidi, P. Cloud Container Technologies: A State-of-theArt Review. IEEE Transactions on Cloud Computing, 7 (3), 677–692 (2019). https://doi.org/10.1109/TCC.2017.2702586Pahl, C., Brogi, A., Soldani, J., and Jamshidi, P. Cloud Container Technologies: A State-of-theArt Review. IEEE Transactions on Cloud Computing, 7 (3), 677–692 (2019). https://doi.org/10.1109/TCC.2017.2702586Rose, S., Borchert, O., Mitchell, S., and Connelly, S. Zero Trust Architecture (NIST Special Publication 800-207) (Gaithersburg: National Institute of Standards and Technology, 2020), 50 p. https://doi.org/10.6028/NIST.SP.800-207Rose, S., Borchert, O., Mitchell, S., and Connelly, S. Zero Trust Architecture (NIST Special Publication 800-207) (Gaithersburg: National Institute of Standards and Technology, 2020), 50 p. https://doi.org/10.6028/NIST.SP.800-207Beyer, B., Jones, C., Petoff, J., and Murphy, N. R. Site Reliability Engineering: How Google Runs Production Systems (Sebastopol: O’Reilly Media, 2016), 552 p.Beyer, B., Jones, C., Petoff, J., and Murphy, N. R. Site Reliability Engineering: How Google Runs Production Systems (Sebastopol: O’Reilly Media, 2016), 552 p.Luksa, M. Kubernetes in Action, 2nd ed. (Shelter Island: Manning Publications, 2022), 856 p.Luksa, M. Kubernetes in Action, 2nd ed. (Shelter Island: Manning Publications, 2022), 856 p.Sigelman, B. H., Barroso, L. A., Burrows, M., et al. Dapper, a Large-Scale Distributed Systems Tracing Infrastructure. Google Technical Report (2010). URL: https://research.google/pubs/pub36356/ (accessed: 02.03.2026).Sigelman, B. H., Barroso, L. A., Burrows, M., et al. Dapper, a Large-Scale Distributed Systems Tracing Infrastructure. Google Technical Report (2010). URL: https://research.google/pubs/pub36356/ (accessed: 02.03.2026).OpenTelemetry Authors. OpenTelemetry: High-quality, portable telemetry to enable effective observability (2024). URL: https://opentelemetry.io/ (accessed: 02.03. 2026).OpenTelemetry Authors. OpenTelemetry: High-quality, portable telemetry to enable effective observability (2024). URL: https://opentelemetry.io/ (accessed: 02.03. 2026).Calavera, D., Fontana, L. Linux Observability with BPF: Advanced Programming for Performance Analysis and Networking (Sebastopol: O’Reilly Media, 2019), 282 p.Calavera, D., Fontana, L. Linux Observability with BPF: Advanced Programming for Performance Analysis and Networking (Sebastopol: O’Reilly Media, 2019), 282 p.Cilium Authors. Cilium Service Mesh (2024). URL: https://cilium.io/use-cases/service-mesh/ (accessed: 02.03.2026).Cilium Authors. Cilium Service Mesh (2024). URL: https://cilium.io/use-cases/service-mesh/ (accessed: 02.03.2026).SPIFFE Authors. SPIFFE: Secure Production Identity Framework for Everyone (Specification) (2024). URL: https://spiffe.io/ (accessed: 02.03.2026).SPIFFE Authors. SPIFFE: Secure Production Identity Framework for Everyone (Specification) (2024). URL: https://spiffe.io/ (accessed: 02.03.2026).Envoy Project Authors. Envoy Proxy: Modern HTTP Proxy and Communication Bus (Documentation) (2024). URL: https://www.envoyproxy.io/ (accessed: 02.03.2026).Envoy Project Authors. Envoy Proxy: Modern HTTP Proxy and Communication Bus (Documentation) (2024). URL: https://www.envoyproxy.io/ (accessed: 02.03.2026).Istio Authors. Istio: Connect, secure, control, and observe services (Documentation) (2024). URL: https://istio.io/ (accessed: 02.03.2026).Istio Authors. Istio: Connect, secure, control, and observe services (Documentation) (2024). URL: https://istio.io/ (accessed: 02.03.2026).Linkerd Authors. Linkerd: Ultralight, security-first service mesh for Kubernetes (Documentation) (2024). URL: https://linkerd.io/ (accessed: 02.03. 2026).Linkerd Authors. Linkerd: Ultralight, security-first service mesh for Kubernetes (Documentation) (2024). URL: https://linkerd.io/ (accessed: 02.03. 2026).Howard, J., et al. Introducing Ambient Mesh. Istio Blog (2022). URL: https://istio.io/latest/blog/2022/introducing-ambient-mesh/ (accessed: 02.03.2026).Howard, J., et al. Introducing Ambient Mesh. Istio Blog (2022). URL: https://istio.io/latest/blog/2022/introducing-ambient-mesh/ (accessed: 02.03.2026).Kubernetes SIG Network. Kubernetes Gateway API (2024). URL: https://gateway-api.sigs.k8s.io/ (accessed: 02.03.2026).Kubernetes SIG Network. Kubernetes Gateway API (2024). URL: https://gateway-api.sigs.k8s.io/ (accessed: 02.03.2026).Istio Authors. Kubernetes Gateway API (Istio Documentation) (2024). URL: https://istio.io/latest/docs/tasks/traffic-management/ingress/gateway-api/ (accessed: 02.03.2026).Istio Authors. Kubernetes Gateway API (Istio Documentation) (2024). URL: https://istio.io/latest/docs/tasks/traffic-management/ingress/gateway-api/ (accessed: 02.03.2026).Istio Authors. Performance and Scalability (2024). URL: https://istio.io/latest/docs/ops/deployment/performance-and-scalability/ (accessed: 02.03.2026).Istio Authors. Performance and Scalability (2024). URL: https://istio.io/latest/docs/ops/deployment/performance-and-scalability/ (accessed: 02.03.2026).

The authors declare that there are no conflicts of interest present.