What a service mesh solves

WHAT THIS TESTS A clear mental model of why teams add a mesh on top of Kubernetes. The interviewer wants the three problem areas and an understanding that Kubernetes itself stops at basic connectivity.

A GOOD ANSWER COVERS A service mesh is a dedicated infrastructure layer for managing communication between services. It is typically implemented as lightweight proxies deployed beside each workload, coordinated by a central control plane. The three problem areas are: traffic management, meaning fine-grained routing, weighted splits, retries, timeouts and canary releases; security, meaning automatic mutual TLS so traffic between pods is encrypted and authenticated plus identity-based authorization; and observability, meaning consistent golden-signal metrics, distributed tracing context propagation, and access logging across every call. Crucially these are applied without changing application code. Plain Kubernetes provides Services, kube-proxy load balancing and DNS, which solve discovery and basic L4 routing but leave L7 routing, encryption and telemetry to you.

COMMON WRONG ANSWERS Confusing a mesh with an Ingress controller or API gateway, which handle north-south edge traffic rather than east-west service traffic. Claiming Kubernetes already encrypts pod-to-pod traffic; it does not by default. Saying NetworkPolicies provide mTLS; they only allow or deny connections at L3 or L4 and do not encrypt or verify identity.

LIKELY FOLLOW-UPS What is the cost of a mesh? Added latency per hop, resource overhead from sidecars, and operational complexity. How does the sidecar intercept traffic? Via iptables or eBPF redirection. When is a mesh overkill for a small cluster?

ONE CONCRETE EXAMPLE Without a mesh, enabling encryption and per-route retries between a checkout service and a payments service means editing both codebases and managing certificates yourself. With Istio or Linkerd, you deploy sidecars, turn on strict mTLS once, and declare a retry policy in a manifest; both services gain encryption, retries and traces with no code changes.