What features does a service mesh like Istio provide?

Istio is a powerful service mesh that provides cross-cutting communication features without any application code changes, through sidecar proxies (Envoy). Key features include: Mutual TLS (mTLS) — automatic encryption and certificate-based authentication for all service-to-service traffic; Traffic management — fine-grained routing rules for canary releases, A/B testing, and weighted traffic splitting; Observability — automatic metrics (Prometheus), distributed tracing (Jaeger/Zipkin), and access logs for every service call; Circuit breaking and retries — configured via Kubernetes custom resources; and Authorization policies — define which services are allowed to call which endpoints. The tradeoff is significant operational overhead — Istio adds latency and requires expertise to configure correctly.