A team I worked with inherited a 40-node VM fleet, three Kubernetes clusters, and a mandate to "adopt a service mesh." They picked Istio because that's what the conference talks said. Six months later they were still debugging sidecar injection edge cases on the VM workloads — workloads that Istio had no clean story for in the first place. The mesh project got cancelled. The underlying problem — services couldn't find each other reliably and everything talked in plaintext — was still there.

Here's the thing nobody tells you: service discovery and mutual TLS are orthogonal to orchestration. You can do both without a control plane welded to Kubernetes. Consul treats them that way, which is exactly why it fits the "unholy hybrid" environments most of us actually run.

This guide is for engineers who need a working mesh across VMs, bare metal, and maybe some K8s — and want to know what it takes to run Consul Connect for real.…