The Negatives to a Per-Host Service Mesh, the Sidecar Model Being a More Ideal Solution for Providing a More Robust Security Boundary
Talkat Linkerd Day Europe 2023 · on Tuesday, 2023-04-18· at 11:25· Hall 7, Room D | Ground Floor | Europe Complex·
summary
Claim: eBPF cannot replace an L7 sidecar because eBPF programs are not Turing-complete, must terminate, cannot block, and fail the verifier for complex logic. Moving the proxy to a node creates a single point of failure, noisy neighbor resource storms, harder mTLS key scoping and the confused deputy risk that lets one compromise impersonate many pods. Keep per-pod sidecars for tight security boundaries and scale; use eBPF/sockmap to accelerate L3/L4 and improve CNI rather than eliminate L7 proxies.
AI-written summary · about
chapters (7)
- 0:00Service mesh trade-offs
- 1:03Sidecar versus per-host debate
- 3:13eBPF limitations
- 5:42Proxy host-level problems
- 8:10Sidecar security benefits
- 9:37eBPF and sidecar improvements
- 12:47Q&A
related talks
27mRevolutionizing Sidecarless Service Mesh With eBPF
39mSecurity & Observability For All Apps - Combining The User/Kernel Powers
04mProject Lightning Talk: Simplifying Cloud-Native Security: eBPF-Powered Encryption in Sidecarless Service Mesh
11mIstio Ambient Mesh: Sidecar vs Sidecar-less, Explained Simply
29mYou Probably DON’T Need a Service Mesh!
36mCloud Native Superpowers with eBPF
33mCNI or Service Mesh? Comparing Security Policies Across Providers
43mA Guided Tour of Cilium Service Mesh