Sidecar pattern -- extend services without modifying them

Need to add cross-cutting concerns (logging, monitoring, security, networking) to services without modifying their code. Each service team should not have to implement these independently.

Deploy a helper container (sidecar) alongside the main application container. The sidecar handles infrastructure concerns: (1) Service mesh proxy (Envoy/Istio): handles TLS, load balancing, retries. (2) Log collector: ships logs to central system. (3) Secret manager: injects secrets at runtime. (4) Auth proxy: handles authentication before requests reach the app. In Kubernetes, sidecars share the pod network namespace, so they communicate via localhost.

Sidecars apply the single responsibility principle at the infrastructure level. The app focuses on business logic; the sidecar handles operational concerns.