Engineering / advanced
Traffic policy between services
Study proxy data paths, identity, discovery, balancing, and failure amplification while evaluating when intermediary layers earn their cost.
Your route through engineering
Follow the path or begin with a question. Every lesson is open.
Your place, at your pace. Progress is optional and saved only in this browser when available.
Read / explore / reason
Inside this module
Module 01 advanced
Traffic policy between services
Study proxy data paths, identity, discovery, balancing, and failure amplification while evaluating when intermediary layers earn their cost.
- 01
Mesh data paths: trace the sockets before counting the proxies
Follow sidecar and node-proxy traffic through interception, network namespaces, TLS boundaries, and optional application-layer waypoints.
24 min - 02
Endpoint discovery: a successful update is still a delayed view
Distinguish DNS, endpoint discovery, resource acceptance, readiness, and the time at which a proxy actually changes forwarding.
24 min - 03
Load balancing: select using a signal with a known scope
Compare round robin, least request, latency-aware selection, and consistent hashing while distinguishing requests, connections, and observed load.
24 min - 04
Outlier ejection: remove a bad destination without losing the fleet
Separate passive observations, active health, ejection limits, and the capacity consequences of a shrinking eligible endpoint set.
24 min - 05
Circuit breakers: separate a recovery state machine from resource bounds
Compare closed/open/half-open recovery with Envoy's per-proxy upstream resource limits and their enforcement scope.
24 min - 06
Proxy retries: one user operation can create many attempts
Count retries across layers, bound deadline consumption, and separate safe repetition from duplicate side effects.
24 min - 07
Identity-aware policy: authentication is evidence, authorization is a decision
Connect workload credentials, peer validation, mesh authorization, application permissions, and policy-enforcement placement.
24 min - 08
Connection draining: stop new work without abandoning old work
Coordinate endpoint removal, protocol-level draining, application shutdown, and bounded stream lifetimes during a rollout.
24 min - 09
Control-plane failure: cached traffic has several expiration clocks
Separate an established data plane from new configuration, startup, endpoint freshness, credential rotation, and resource TTL expiry.
24 min - 10
Proxy cost: measure useful operations, attempts, and critical paths
Attribute latency, CPU, memory, and connection work to a defined boundary while avoiding double-counted spans and misleading benchmark comparisons.
24 min