Cilium Service Mesh
summary
Cilium uses eBPF in kernel plus Envoy to implement a sidecar-free data path, claiming massive performance gains and simpler architecture while remaining compatible with existing control planes like Istio. It runs Envoy listeners per thread in a pod cgroup, enforces mTLS for any protocol, and falls back to a single proxy when L7 features (TLS termination, L7 LB, rate limiting) are required. A concrete example is sockmap which avoids loopback cleartext by keeping traffic in-kernel, and benchmarks show native eBPF HTP parsing far outperforms sidecar parsing.
AI-written summary · about
chapters (10)
- 0:00Intro
- 4:30SockMap
- 5:27Service Mesh
- 6:07Service Mesh Origins
- 6:26Sidecars
- 8:20observability
- 8:32multitenancy
- 8:50integration
- 9:22ebpf
- 10:02Conclusion
related talks
31mThe Future of Service Meshes: Sidecarless or eBPF?
44mCilium - Container Security and Networking Using BPF and XDP
35mNext-level Kubernetes Networking with Cilium - Nico Meisenzahl and Philip Welz
27mCilium Cluster Mesh: The eBPF-Powered Multicluster Solution for Kubernetes
24mThe Cilium Story - Why We Created Cilium
22mRevolutionizing Mesh Layers: Transitioning from Istio to Cilium at...
07mThe Cilium Vision
39mThe evolution of service mesh with eBPF