---
title: "Service Mesh Data Plane Architecture"
description: "An in-depth exploration of the core components and capabilities of the service mesh data plane"
keywords: ["service mesh", "Envoy", "xDS", "circuit breaking", "canary deployments", "mTLS", "Istio", "Linkerd"]
category: "networking"
---

The service mesh data plane is the critical runtime layer that handles all network traffic between microservices in a distributed application. At the heart of the data plane is the Envoy proxy, which is automatically injected as a sidecar container alongside each application container. Envoy v1.21.0 provides the core functionality to handle service discovery, load balancing, retries, timeouts, circuit breaking, and mTLS encryption. 

The Envoy proxies communicate with the control plane using the xDS API protocol, a set of gRPC-based APIs that allow dynamic configuration updates. The xds-v3 version of the protocol introduces support for advanced traffic management features like retry budgets and outlier detection. Envoy can be configured to use a fixed retry budget, such as max_retries: 5, or a dynamic budget that scales with load. Outlier detection monitors the health of upstream hosts and can dynamically eject unhealthy instances from the load balancing pool.

Circuit breaking is a critical component for handling cascading failures and maintaining service level objectives. Envoy allows granular configuration of circuit breakers at the connection, request, and retries level, with parameters like max_connections: 100, max_pending_requests: 100, and max_retries: 3. These can be tuned based on the specific failure modes and traffic patterns of each service.

Canary deployments are a common pattern for safely rolling out new versions of services. Envoy supports advanced traffic splitting capabilities to gradually shift traffic between old and new versions. The traffic_split filter can be configured to send a percentage of requests, such as 10%, to the canary version, while the remaining 90% go to the stable version. Metrics from the canary can then be analyzed before fully promoting the new version.

Mutual TLS (mTLS) is a core security feature of the service mesh, providing end-to-end encryption and strong identity verification between services. Envoy handles all the certificate management and rotation automatically, using the SDS (Secret Discovery Service) API to fetch new certificates from the control plane. This allows seamless key rotation without disrupting ongoing traffic.

When comparing popular service mesh implementations, Istio v1.14.0 and Linkerd v2.11.0 have some key differences in their data plane architectures. Istio uses the Envoy proxy, while Linkerd has its own lightweight proxy built on Rust. Istio provides a richer set of traffic management features like circuit breaking and retries, while Linkerd has a stronger focus on observability and security. Ultimately, the choice between the two depends on the specific requirements and constraints of the application.

Finally, the service mesh data plane can be extended with WebAssembly (WASM) filters to add custom logic and functionality. Envoy v1.21.0 supports loading WASM modules that can perform tasks like header manipulation, metrics collection, and policy enforcement. This allows developers to build highly specialized data plane capabilities tailored to their application's needs.The Envoy sidecar proxy is automatically injected into each application pod through a process called sidecar injection. This is typically handled by the service mesh control plane, which uses mutating webhooks to transparently modify the Kubernetes pod spec before it is scheduled. The istioctl CLI in Istio v1.14.0 provides commands like istioctl kube-inject to automate this injection process. Linkerd v2.11.0 has a similar sidecar injection mechanism that can be enabled with the linkerd inject command.

The xDS API protocol defines a set of resources that the Envoy proxy uses to discover and configure various aspects of the service mesh. The Endpoint Discovery Service (EDS) provides information about the available instance endpoints for each service. The Cluster Discovery Service (CDS) defines the load balancing settings and circuit breakers for each upstream cluster. The Route Discovery Service (RDS) configures the HTTP routing rules, including header manipulation, query parameter transforms, and traffic splitting. Finally, the Listener Discovery Service (LDS) manages the inbound and outbound network listeners on the Envoy proxy.

Retry budgets are a sophisticated mechanism for controlling the rate of retries within the service mesh. Rather than using a fixed retry limit, Envoy can be configured with a dynamic budget that scales based on the current traffic load. The retry_budget filter specifies parameters like max_retries_per_second and budget_factor to throttle retries and prevent cascading failures. This allows the mesh to be more resilient to transient errors while still maintaining tight control over resource utilization.

Outlier detection is another advanced Envoy feature that monitors the health of upstream hosts and dynamically ejects unhealthy instances from the load balancing pool. The outlier_detection filter configures settings like consecutive_5xx, max_ejection_percent, and base_ejection_time to define the criteria for when a host is considered an outlier. This helps maintain service level objectives by automatically removing poorly performing instances from the request path.

Istio v1.14.0 and Linkerd v2.11.0 take different approaches to the service mesh data plane. Istio leverages the full power of the Envoy proxy, providing a rich set of traffic management features like circuit breaking, retries, and canary deployments. Linkerd, on the other hand, has a more lightweight and opinionated data plane built on Rust. While Linkerd may have a smaller feature set, it is designed to be simpler to operate and more resource efficient, making it a popular choice for environments with tight constraints.

In addition to the standard Envoy filters, the service mesh data plane can be further extended using WebAssembly (WASM) modules. WASM allows developers to write custom filter logic in languages like Rust, AssemblyScript, or C++, which can then be dynamically loaded into the Envoy proxy. This enables a wide range of advanced use cases, such as header-based routing, custom metrics collection, and specialized security policies. Istio v1.14.0 supports WASM extensions through the WebAssembly Hub, while Linkerd v2.11.0 provides a similar capability through its external component model.The sidecar injection process in service meshes like Istio and Linkerd is a crucial step that transparently adds the Envoy proxy to each application pod. In Istio v1.14.0, the istioctl kube-inject command can be used to modify the Kubernetes pod specification, automatically injecting the Envoy sidecar container and configuring the necessary networking and security settings. Linkerd v2.11.0 provides a similar functionality through the linkerd inject command, which inserts the Linkerd-specific proxy into the application pods.

The xDS API protocol is the foundation of the service mesh control plane, enabling dynamic configuration updates to the Envoy proxy. The Endpoint Discovery Service (EDS) informs Envoy about the available instance endpoints for each service, allowing the proxy to load balance traffic accordingly. The Cluster Discovery Service (CDS) configures the upstream clusters, including settings for load balancing, circuit breaking, and outlier detection. The Route Discovery Service (RDS) defines the HTTP routing rules, enabling advanced traffic management capabilities like header manipulation, query parameter transformations, and canary deployments. Finally, the Listener Discovery Service (LDS) manages the inbound and outbound network listeners on the Envoy proxy.

Retry budgets in Envoy provide a sophisticated mechanism for controlling the rate of retries within the service mesh. Rather than using a fixed retry limit, the retry_budget filter allows for a dynamic budget that scales based on the current traffic load. This is configured using parameters such as max_retries_per_second and budget_factor, which throttle the retries and prevent cascading failures. By adapting the retry budget to the real-time traffic patterns, the service mesh can maintain high availability and resilience while still optimizing resource utilization.

Outlier detection is another advanced Envoy feature that monitors the health of upstream hosts and dynamically ejects poorly performing instances from the load balancing pool. The outlier_detection filter configures settings like consecutive_5xx, max_ejection_percent, and base_ejection_time to define the criteria for when a host is considered an outlier. This helps maintain service level objectives by automatically removing unhealthy instances from the request path, improving the overall reliability and performance of the service mesh.

When comparing the service mesh implementations of Istio v1.14.0 and Linkerd v2.11.0, there are some key differences in their data plane architectures. Istio leverages the full power of the Envoy proxy, providing a rich set of traffic management features like circuit breaking, retries, and canary deployments. Linkerd, on the other hand, has a more lightweight and opinionated data plane built on Rust, which may have a smaller feature set but is designed to be simpler to operate and more resource-efficient. The choice between the two depends on the specific requirements and constraints of the application, such as the need for advanced traffic control capabilities or the availability of system resources.

Beyond the standard Envoy filters, the service mesh data plane can be further extended using WebAssembly (WASM) modules. WASM allows developers to write custom filter logic in languages like Rust, AssemblyScript, or C++, which can then be dynamically loaded into the Envoy proxy. This enables a wide range of advanced use cases, such as header-based routing, custom metrics collection, and specialized security policies. Istio v1.14.0 supports WASM extensions through the WebAssembly Hub, while Linkerd v2.11.0 provides a similar capability through its external component model, allowing for a high degree of flexibility and customization in the service mesh data plane.The Envoy sidecar proxy is automatically injected into each application pod through a process known as sidecar injection, which is typically handled by the service mesh control plane. This is done using mutating webhooks that transparently modify the Kubernetes pod specification before it is scheduled. In Istio v1.14.0, the istioctl kube-inject command can be used to automate this injection process, while Linkerd v2.11.0 provides a similar functionality through the linkerd inject command.

The xDS API protocol is the foundation of the service mesh control plane, enabling dynamic configuration updates to the Envoy proxy. This protocol defines a set of resources that Envoy uses to discover and configure various aspects of the service mesh, including service endpoints (EDS), upstream clusters (CDS), routing rules (RDS), and network listeners (LDS). These resources are delivered to the Envoy proxy using gRPC-based APIs, allowing for real-time updates to the data plane without disrupting ongoing traffic.

Circuit breaking is a critical component of the service mesh data plane, providing a mechanism to handle cascading failures and maintain service level objectives. Envoy allows granular configuration of circuit breakers at the connection, request, and retries level, with parameters such as max_connections, max_pending_requests, and max_retries. These settings can be tuned based on the specific failure modes and traffic patterns of each service, ensuring that the service mesh remains resilient and responsive even under high load or failure conditions.

Canary deployments are a common pattern for safely rolling out new versions of services within the service mesh. Envoy supports advanced traffic splitting capabilities to gradually shift traffic between old and new versions of a service. The traffic_split filter can be configured to send a percentage of requests, such as 10%, to the canary version, while the remaining 90% go to the stable version. This allows the service mesh to monitor the performance and health of the canary before fully promoting the new version to production.

Mutual TLS (mTLS) is a core security feature of the service mesh, providing end-to-end encryption and strong identity verification between services. Envoy handles all the certificate management and rotation automatically, using the SDS (Secret Discovery Service) API to fetch new certificates from the control plane. This allows seamless key rotation without disrupting ongoing traffic, ensuring that the service mesh maintains a high level of security and compliance.

When comparing the service mesh implementations of Istio v1.14.0 and Linkerd v2.11.0, there are some notable differences in their data plane architectures. Istio leverages the full power of the Envoy proxy, providing a rich set of traffic management features like circuit breaking, retries, and canary deployments. Linkerd, on the other hand, has a more lightweight and opinionated data plane built on Rust, which may have a smaller feature set but is designed to be simpler to operate and more resource-efficient. The choice between the two depends on the specific requirements and constraints of the application, such as the need for advanced traffic control capabilities or the availability of system resources.

The service mesh data plane can be further extended using WebAssembly (WASM) filters, which allow developers to write custom logic in languages like Rust, AssemblyScript, or C++, and dynamically load it into the Envoy proxy. This enables a wide range of advanced use cases, such as header-based routing, custom metrics collection, and specialized security policies. Istio v1.14.0 supports WASM extensions through the WebAssembly Hub, while Linkerd v2.11.0 provides a similar capability through its external component model, offering a high degree of flexibility and customization in the data plane.