Service Mesh

The fully managed service mesh based on Istio

Illustration of a laptop, data base, stack of web pages, and game controller linked to cloud.

Think services first

Architecting your applications as microservices provides many benefits. However, your workloads can get complex and fragmented as they scale.

Service Mesh is Google's implementation of the powerful Istio open-source project, allowing you to manage, observe, and secure your services without having to change your application code.

Service Mesh unburdens your operations and development teams by simplifying service delivery across the board, from traffic management and mesh telemetry to securing communications between services.

Google’s fully managed service mesh lets you easily manage complex environments and enjoy the benefits they promise.

Blue circle icon with computer monitor and gears

Fully managed, full stop

Since it’s a fully managed offering, Service Mesh takes all the guesswork and effort out of procuring and managing your service mesh solution. You focus on developing great apps; let us worry about your mesh.

Blue circle icon with security shield over bar graph

Understand your apps

Your mesh can’t be at its most efficient if you can’t see how it’s operating. Service Mesh’s robust tracing, monitoring, and logging features give you deep insights into how your services are performing, how that performance affects other processes, and any issues that might exist.

Blue circle icon with bar graph balancing gear wheel

Security simplified

Securing your service mesh can feel daunting. Service Mesh helps you embrace a zero-trust security model by giving you the tools to automatically and declaratively secure your services and their communication. You can manage authentication, authorization, and encryption between services with a diverse set of features—all with little or no changes to the applications themselves.

Blue circle icon of magnifying glass focused on one of interconnected nodes

Easy traffic management

With Service Mesh, you can control traffic flows and API calls between services while also gaining visibility into your traffic. This makes calls more reliable and your network more robust, even in adverse conditions, while enabling you to catch issues before they become problems.

Features

Deep visibility built in [beta]

Service Mesh’s integration with Cloud Logging, Cloud Monitoring, and Cloud Trace opens up a wide range of features, including the ability to monitor SLOs at a per-service level and set targets for latency and availability. It also automatically generates graphs and tracks your compliance over time, providing comparisons to your “error budget.”

Easy authentication, encryption

Transport authentication via mTLS (Mutual Transport Layer Security) has never been easier. Secure your service-to-service and end-user-to-service communications with a single click mTLS installation or incremental implementation.

Flexible authorization

Decide who has access to what services in your mesh with easy-to-use role-based access control (RBAC). You specify the permissions, then grant access to them at the level you choose, from namespace all the way down to users.

Fine-grained traffic controls

Service Mesh decouples traffic flow from infrastructure scaling, opening up many traffic management features, including dynamic request routing for A/B testing, canary deployments, and gradual rollouts—all outside of your application code.

Failure recovery out of the box

Service Mesh provides a number of critical failure-recovery features out of the box that can be configured dynamically at runtime, including timeouts, circuit breakers, active health checks, and bounded retries.

Fault injection tools

Even with robust failure-recovery features, it’s critical to test your mesh’s resilience. That’s where fault injection comes in. You can easily configure delay and abort faults to be injected into requests that match certain conditions, and even restrict the percentage of requests that should be subjected to faults.

Load balancing

Choose between round robin (each healthy upstream host is selected in order), random (load balancer selects a random healthy host), and weighted-least-request load balancing.

Hybrid service mesh

Service Mesh also supports a hybrid service mesh. This gives you the flexibility to have a common mesh that spans both your Google Cloud and on-prem deployments.

Managed by Google

Service Mesh gives you a Google-managed control plane and an optional data plane that you simply configure. Google handles their reliability, upgrades, scaling and security for you.