Problems with just using Helm + Vanilla K8s

Helm is packaging, not a runtime plane. We will have following isses

When to use a service mesh vs. no service mesh

Service Mesh (e.g., Istio, Linkerd) No Service Mesh (Vanilla K8s)
Ideal for... Complex microservice architectures with many services. Small, simple applications or a limited number of services.
Security Automatically enforces a zero-trust security model with mTLS and fine-grained authorization policies without touching application code. Requires manual implementation and certificate management, which is difficult to scale and maintain.
Traffic Management Provides advanced routing, retries, circuit breaking, and canary deployments. Offers only basic Layer 4 load balancing. Advanced traffic control must be handled by an Ingress controller or complex network configurations.
Observability Aggregates detailed metrics, distributed tracing, and logging for all service traffic out of the box. Lacks comprehensive visibility into service-to-service communication. You must instrument applications with code to get basic telemetry.
Operational Overhead Adds complexity and a learning curve for operators due to sidecar proxies and a control plane. Simple to start, but operational complexity grows with each service you secure manually.

Service Mesh Options

Costs / pitfalls of a service mesh (be honest about these)