Istio

Istio injects a sidecar proxy (Envoy) alongside every pod in your Kubernetes cluster. That proxy intercepts all network traffic and gives you fine-grained control: canary deployments, circuit breaking, retry policies, distributed tracing, and automatic mTLS between services. All configured with Kubernetes custom resources.

CNCF project. Used by eBay, Salesforce, T-Mobile, and many large Kubernetes operators. Fully free. Apache 2.0 license. Google, IBM, and others offer managed Istio (Google's Anthos Service Mesh, IBM's Istio on IKS).

This is not for small teams. Istio adds operational complexity that only pays off when you have enough services (15+) that manual networking management breaks down. Below that threshold, you're adding pain for minimal gain.

The catch: Istio is notoriously complex. The sidecar model adds latency and resource overhead to every pod. Configuration is sprawling. Debugging networking issues through the mesh is harder, not easier, until you really understand it. Linkerd is simpler if you just need mTLS and observability.