A Guided Tour of Cilium Service Mesh
summary
Cilium extends its eBPF-based CNI into a service mesh that routes L3/L4 in-kernel and calls out to Envoy only for layer 7 visibility, demonstrated by a live demo that blocks an HTTP POST to the “exhaust port” via a L7 network policy and serves ingress traffic via an auto-generated CiliumEnvoyConfig; measurements show similar throughput, marginally better latency, and pod startup time improved versus sidecars, with per-node resource savings because Cilium runs one proxy per node and plans mTLS/auth separation using kernel encryption.
AI-written summary · about
chapters (9)
- 0:00Start
- 4:04The History of Service Mesh
- 7:58Layer Seven Visibility
- 10:42Layer 7 Network Policy
- 13:37Observability
- 16:53Ingress
- 22:50Reducing Resources
- 38:59Debugging
- 40:07Envoy Configuration
related talks
05mUnlocking Next-Gen Networking and Security with Cilium Service Mesh
37mService MESH without the MESS - Raymond de Jong
35mNext-level Kubernetes Networking with Cilium - Nico Meisenzahl and Philip Welz
43mService MESH without the MESS
27mCilium Cluster Mesh: The eBPF-Powered Multicluster Solution for Kubernetes
44mCilium - Container Security and Networking Using BPF and XDP
22mOne Project, Different Angles: How to Secure and Observe with Cilium
31mCilium Mesh