Kubernetes Istio service mesh architecture with Istiod control plane managing Envoy sidecar proxies across frontend, backend, and database tiers in the production namespace. Traffic flows from external users through the Istio Ingress Gateway to VirtualServices and DestinationRules, which route requests to Kubernetes Services and Pods with automatic mTLS encryption via Citadel. The control plane components—Pilot, Citadel, and Galley—configure network policies, service accounts, and TLS certificates, while etcd persists cluster state and HPA controllers scale frontend and backend deployments based on demand. Fork this diagram to customize traffic policies, add canary deployments, or integrate observability tools like Prometheus and Jaeger for production service mesh governance.