The Real Cost of a Service Mesh: Istio Sidecar Overhead in Production

Istio does not appear on your infrastructure budget as a line item. It appears as a gradual expansion of your node count, an unexplained increase in CPU utilization across the cluster, and a growing gap between what your application pods request and what nodes actually deliver. The mechanism is the sidecar. Every pod in an Istio mesh gets an Envoy proxy injected at admission. That proxy handles mTLS termination, telemetry collection, and traffic management. At idle, it consumes 50-100 millicores