A service mesh is a dedicated infrastructure layer for managing all communication between microservices in a distributed system. It is implemented as a set of lightweight network proxies (sidecars) deployed alongside each service, which intercept all inbound and outbound traffic — without requiring any changes to the application code.
What a service mesh provides
Mutual TLS (mTLS): Every service-to-service connection is encrypted and mutually authenticated. Both the client and server must present valid certificates before any data is exchanged. This eliminates a broad class of attacks including man-in-the-middle interception, credential replay, and lateral movement after initial compromise.
Traffic management: Intelligent routing rules — canary deployments (send 5% of traffic to a new version), circuit breaking (stop sending traffic to a failing service), retries (automatically retry failed requests), and timeout enforcement — without writing this logic in application code.
Observability: Every request — its latency, error rate, payload size, and route — is automatically instrumented without application code changes. This provides the golden signals (latency, traffic, errors, saturation) required for SRE-standard observability.
Policy enforcement: Authorisation policies specify which services are allowed to communicate with which other services — rejecting all traffic not explicitly permitted. This implements zero-trust network segmentation within the cluster.
The compliance case for service meshes
For RBI-regulated financial entities and ABDM-compliant healthcare systems, the requirement to encrypt all data in transit extends to internal service-to-service communication — not just external-facing APIs. A service mesh is the only practical mechanism to enforce this at scale without instrumenting every application individually. The audit trail generated by a service mesh (every request logged with source, destination, protocol, and outcome) also satisfies the transaction monitoring and audit requirements of multiple Indian regulatory frameworks.