Service MESH without the MESS
summary
Cilium uses eBPF in the kernel to replace per-pod sidecars for most networking and observability, cutting resource use and startup/routing latency and showing 2–4x latency reduction in measurements; Layer 3/4 load balancing runs in-kernel while Layer 7 routes and TLS termination use Envoy listeners per namespace, exported to Hubble and to Prometheus/Grafana/Tempo via OpenTelemetry; recent releases (1.12/1.13) add Gateway API, shared cloud load balancers and cluster-mesh multi-cluster L7 balancing, while full in-kernel TLS decryption remains impractical today.
AI-written summary · about
chapters (21)
- 0:00Start
- 1:48Run eBPF programs on events
- 5:47Service Mesh Origins
- 6:05Service Mesh with Sidecars
- 6:27Service Mesh Evolution
- 6:42Layer 7 is the only part which is not yet there
- 8:07Cilium agent per node
- 9:14What is different with Cilium Service Mesh?
- 9:57Reduce resource usage - sidecar vs proxy per node
- 10:40Cost of sidecar injection
- 11:12eBPF powered network path for L3/L4 traffic
- 11:43Envoy for Layer 7 termination when needed
- 12:03Latency performance
- 12:24Throughput performance
- 15:15Cilium 1.13 Release
- 17:36TLS Termination
- 17:47Shared LoadBalancer for Ingress Resources
- 18:41Gateway API
- 20:51Service + Annotations + Cluster Mesh Compatible with Cluster Mesh load balancing
- 22:29HTTP Golden Signals
- 23:02Detecting Transient Network Layer Issues
related talks
37mService MESH without the MESS - Raymond de Jong
05mUnlocking Next-Gen Networking and Security with Cilium Service Mesh
43mA Guided Tour of Cilium Service Mesh
27mCilium Cluster Mesh: The eBPF-Powered Multicluster Solution for Kubernetes
35mNext-level Kubernetes Networking with Cilium - Nico Meisenzahl and Philip Welz
31mCilium Mesh
36mCilium: Welcome, Vision and Updates
32mBreaking Boundaries: Multi-cluster with Cilium cluster mesh