Istio
Service mesh for Kubernetes — Google + IBM + Lyft, 2017. Routes traffic between microservices with Envoy as sidecar proxy and a central control plane.
Features: mutual TLS between services, traffic splitting (canary, blue-green), retries, circuit breaking, observability (with Prometheus + Grafana + Jaeger). Config via CRDs (VirtualService, DestinationRule, Gateway).
Complex to operate — 2024 brought "Ambient Mode" that removes sidecars for large parts of traffic. Competitor: Linkerd (simpler, Rust-based), Cilium Service Mesh (eBPF), Consul Connect.