Project Lightning Talk: Simplifying Cloud-Native Security: eBPF-Powered Encryption in Sidecarless Service Mesh
Lightningat KubeCon + CloudNativeCon Europe 2025 · on Tuesday, 2025-04-01· at 12:27· Platinum Suite | Level 3·
summary
K mesh is an eBPF-based kernel dataplane that implements sidecarless service mesh with two modes: kernel mode offloads L4 and simple L7 policies into the kernel using TC hooks, D-engine mode keeps L7 in userspace for smoother rollouts. Node-to-node encryption uses IPSec for link encryption with an API-server-driven key provisioning and an eBPF map to mark and route packets. Planned socket-level encryption uses socket migration and multi-key management and simple tests show 30% throughput improvement over Envoy.
AI-written summary · about
related talks
36mCloud Native Superpowers with eBPF
27mRevolutionizing Sidecarless Service Mesh With eBPF
06mLightning Talk: Securing Your Systems with Service Mesh
07mLightning Talk: Armoring Cloud Native Workloads with BPF LSM
05mUnlocking Next-Gen Networking and Security with Cilium Service Mesh
18mThe Negatives to a Per-Host Service Mesh, the Sidecar Model Being a More Ideal Solution for Providing a More Robust Security Boundary
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security
05mProject Lightning Talk: Practical Extension of eBPF Usability in KubeCon