Back to 20 Concepts
scaling • Advanced
API Gateways & Service Mesh: North-South vs East-West Traffic
API Gateways (Kong, Envoy, AWS API Gateway) manage North-South external client traffic (auth, rate limiting, TLS). Service Meshes (Istio, Linkerd) manage East-West internal microservice-to-microservice traffic with mTLS sidecars.
Intuitive Mental Model
The Airport Border Security vs Domestic Gate Shuttles: The API Gateway is the international customs border checkpoint (North-South). The Service Mesh is the secure automated tram system connecting domestic airport terminals (East-West).
Architecture Blueprint & CodeProduction Standard
// Service Mesh Sidecar Proxy (Envoy): // App Container -> localhost:15001 -> Envoy Sidecar (mTLS Encryption) -> Network -> Envoy Sidecar -> Target App
Key Architectural Takeaways
- •North-South: Traffic entering from public internet into private VPC cluster.
- •East-West: Inter-service communication between Kubernetes Pods in the same cluster.
- •mTLS: Mutual TLS authentication automatically applied to every internal RPC call by sidecar proxies.
Common Architectural Pitfall
Adding heavy authentication JWT signature verification logic inside every individual microservice.
Production Best Practice
Offload authentication, rate limiting, and TLS termination to the centralized API Gateway.