How Many Proxies Do You Need?
summary
Argues that sidecarless ≠ proxyless and demonstrates a hybrid model: push L3/L4, policy and observability into the kernel with eBPF-native L3/L4, then fall back to Envoy for path/header‑based L7 features. Shows one‑proxy‑per‑node and network/waypoint options, and a practical mTLS design where an mTLS handshake provides identity while symmetric encryption runs in‑kernel via mtls handshake + WireGuard/IPsec. Demos report working eBPF metrics into Prometheus/Grafana and Envoy handling L7 routing at expected performance.
AI-written summary · about
chapters (10)
- 0:00Start
- 1:01Service Mesh Origins
- 1:48Sidecar Complications
- 10:24Proxy per pod (sidecar model)
- 11:37Proxy on the node
- 14:46Cilium network level encryption
- 15:37Cilium Next-Gen Mutual Authentication
- 18:09SPIFFE Integration
- 24:37Layer 7 Traffic Management Options
- 26:06Gateway API
related talks
31mThe Future of Service Meshes: Sidecarless or eBPF?
48mProxies, Gateways, and Service Mesh. Why Are Words so Confusing?
41mPanel Discussion - The Future of Service Mesh: Is eBPF a Silver Lining or a Silver Bullet
11mLightning Talk: Clearing the confusion about eBPF and service mesh
39mThe evolution of service mesh with eBPF
11mCilium Service Mesh
23mSYN Proxy at Scale with BPF
27mEnvoy Proxy: Evolved for Serving LLMs