Api Gateway hard
In a modern cloud-native architecture, what is the most precise distinction between the role of an API Gateway and a Service Mesh (e.g., Istio/Envoy sidecars)?
- A The API Gateway manages the 'North-South' traffic (external client to internal services) and edge concerns like monetization, while the Service Mesh manages 'East-West' traffic (service-to-service) and internal reliability like mTLS and retries.
- B The API Gateway is a centralized hardware appliance, while the Service Mesh is a strictly software-defined network for local development.
- C The Service Mesh handles the application's business logic, whereas the API Gateway is restricted to simple packet forwarding.
- D API Gateways are deprecated in architectures that use Kubernetes; the Service Mesh is the only routing layer required.
Answer: A. The API Gateway manages the 'North-South' traffic (external client to internal services) and edge concerns like monetization, while the Service Mesh manages 'East-West' traffic (service-to-service) and internal reliability like mTLS and retries.
While both may use the same underlying technology (like Envoy), they serve different scopes. The Gateway is the 'Front Door'—it handles messy external clients, authentication, and API product management. The Mesh is the 'Hallway' proxying—it provides a uniform data plane for secure, reliable internal communication between microservices.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- Your Gateway communicates with backends via HTTP/1.1 connections. A slow backend service causes 'Head-of-Line Blocking'. How does switching to HTTP/2 as the Gateway-to-Backend transport mitigate this?
- What is the primary architectural role of an API Gateway in a microservices environment?
- Why is 'Stateless Token Validation' (e.g., using JWTs) significantly more scalable at the Gateway level than 'Stateful Validation' (e.g., using Opaque/Reference Tokens)?
- Your Gateway is configured to cache any URL ending in `.css` or `.jpg`. An attacker tricks a victim into visiting `https://api.com/v1/profile/info/style.css`. How can this lead to an 'Account Takeover'?
- An API is receiving a sudden surge of 10,000 requests per second from a single IP address. How does an API Gateway preserve the stability of the backend services?
- How can an API Gateway help prevent 'Double Charging' in a payment system when a mobile client retries a failed request due to a poor connection?