Microservices

The term was consolidated by James Lewis and Martin Fowler's March 2014 article, which described characteristics rather than a specification: componentisation via services rather than in-process libraries, organisation around business capabilities, products not projects, smart endpoints and dumb pipes, decentralised governance and data management, infrastructure automation, design for failure and evolutionary design. Service boundaries are usually drawn along bounded contexts from domain-driven design, and Conway's law (1968) predicts that they will mirror team structure - which is why the style is as much an organisational choice as a technical one.

Owning data per service is the defining and hardest constraint. Without a shared database there are no cross-service ACID transactions, so consistency is achieved with sagas (a chain of local transactions with compensating actions), the transactional outbox pattern to publish events atomically with state changes, idempotent consumers and eventual consistency. Communication is either synchronous (REST over HTTP, gRPC) or asynchronous (Kafka, AMQP brokers); synchronous chains multiply latency and failure probability, because availability of a call path is roughly the product of the availabilities of its hops. Resilience patterns - timeouts, retries with exponential backoff and jitter, circuit breakers, bulkheads - and distributed tracing with W3C Trace Context propagation, typically via OpenTelemetry, are therefore mandatory rather than optional. A system that must be deployed in lockstep or shares a schema across services is a "distributed monolith": it pays the network cost without the independence.

Security changes shape rather than simply growing. Perimeter controls at an API gateway handle north-south traffic, but east-west calls between services need their own authentication and authorisation. NIST SP 800-204 (2019) sets out security strategies for microservices, and its companions SP 800-204A and 800-204B cover service-mesh deployment and attribute-based access control within a mesh. A service mesh such as Istio or Linkerd gives every workload a cryptographic identity (often in SPIFFE format), enforces mutual TLS and applies per-route policy through sidecar or node-level proxies. End-user identity is propagated with signed tokens (JWT access tokens, OAuth 2.0 token exchange per RFC 8693) so that each service can enforce object-level authorisation itself; failing to do so produces Broken Object Level Authorization, API1:2023 in the OWASP API Security Top 10.

Microservices are an architecture style and are independent of containers or Kubernetes, though they are commonly deployed that way. They contrast with a modular monolith, which enforces module boundaries inside one deployable and avoids network failure modes; for small teams that is often the better trade-off, and several well-publicised migrations have gone back from microservices to fewer, larger services.