Skip to content
ENExplore Calculators

Istio Sidecar CPU Calculator

Estimate CPU overhead added by an Istio Envoy sidecar under request load.

About Istio Sidecar CPU Calculator

Envoy's CPU cost per pod scales with request throughput and the features enabled on the proxy — mutual TLS adds encryption/decryption cost on every connection, and access logging adds per-request serialization overhead. Formula: cpu_millicores = base(100) + 0.5 × RPS + mtls_overhead(50 if enabled) + logging_overhead(30 if enabled), then multiplied across all mesh pods for total CPU demand.

Formulas

Per-sidecar CPU

cpu_millicores = 100 + 0.5 × RPS + mtls_overhead + logging_overhead

RPS
Requests per second through the sidecar
mtls_overhead
50 millicores if mTLS enabled, 0 otherwise
logging_overhead
30 millicores if access logging enabled, 0 otherwise

Total mesh CPU

total_mesh_cpu_cores = (cpu_per_sidecar × pod_count) / 1000

cpu_per_sidecar
CPU per sidecar in millicores
pod_count
Number of pods in the mesh

Worked example

With the default values below, Istio Sidecar CPU Calculator returns CPU per Sidecar of 230.0. Change any input above and every figure here is recalculated in your browser.

Inputs used

Request Rateaccepts 0–1,000,000 req/s
100 req/s
mTLS Enabled
Yes
Access Logging Enabled
Yes
Pod Countaccepts 1–1,000,000 pods
50 pods

Results

CPU per Sidecar
230.0 millicores
Total Mesh CPU
11.50 cores
Total Mesh CPU
11,500 millicores
mTLS Overhead
50 millicores
Access Logging Overhead
30 millicores

Step by step

  1. 1Throughput cost= 50.0m
  2. 2mTLS overhead= 50m
  3. 3Access logging overhead= 30m
  4. 4Per-sidecar CPU: base + throughput + mTLS + logging= 230.0m
  5. 5Total mesh CPU= 11500m (11.50 cores)

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Is mTLS overhead worth it?

For most services yes — the security benefit of encrypted, authenticated service-to-service traffic outweighs a modest, roughly fixed CPU cost per sidecar, especially since Envoy uses efficient TLS session reuse to amortize the cost across requests.

Can I disable access logging to save CPU?

You can, but you lose per-request observability at the mesh layer. A common middle ground is sampling access logs (e.g. only log errors or a percentage of traffic) rather than disabling entirely.

How does this compare to the application container's own CPU usage?

Sidecar CPU is additive overhead on top of your application — for high-RPS, latency-sensitive services this overhead can be a meaningful fraction of total pod CPU, which is one reason ambient mesh (sidecar-less) modes have gained interest.

Should I size CPU requests/limits differently for the sidecar vs. the app container?

Yes — Istio lets you set proxy resource requests/limits independently via annotations or the global mesh config, and this estimate should feed directly into the `istio-proxy` container's own resource spec.

Related Calculators

Istio Sidecar CPU Calculator | Calcrivo