<p>I am quite confused about where k8s regular service and istio's sidecar reside. </p>

<p>I recently learned about istio and its "sidecar/envoy/proxy" inside the pod. And i am confident in saying that istio's sidecar resides inside the pod. But where does the k8s regular service reside and who is contacted first from the app, the Service or the Proxy/Sidecar?</p>

<p>The diagram in my mind is something like:
<img src="https://i.stack.imgur.com/jZkZu.png" alt="The diagram in my mind is something like"></p>

Finley Ben
<p><a href="https://kubernetes.io/docs/concepts/services-networking/service/" rel="nofollow noreferrer">Services</a> are internal abstract REST objects like: loadbalancer, clusterip, nodeport, etc. Their definition is stored in Kubernetes API server (etcd).</p>
<p>Services usually are implemented by Kube-proxy and are also assigned to endpoints by matching selectors and labels.</p>
<p>Each node is running an instance of kube-proxy that is managed by etcd. Services are most of time stored as sets of rules in iptables.</p>
<hr />
<p>Istio services that are used in service mesh are located in Istio control plane and can be used as gateways, egress, ingress, virtualservices etc objects.</p>
<p>The istio control plane also cosists of:
Citadel: for key and certificate management
Pilot: to distribute authentication policies and secure naming information to the proxies
Mixer: to manage authorization and auditing</p>
<p>As you mentioned sidecar proxies (envoy proxy) are injected into pods next to application container.</p>
<p>Here is graph from istio <a href="https://istio.io/latest/docs/concepts/security/#high-level-architecture" rel="nofollow noreferrer">documentation</a>.
<a href="https://web.archive.org/web/20200114173104/https://istio.io/docs/concepts/security/architecture.svg" rel="nofollow noreferrer"><img src="https://web.archive.org/web/20200114173104/https://istio.io/docs/concepts/security/architecture.svg" alt="Istio Security Architecture" /></a></p>
