License & Deployment Mix: 13 tools – 6 OSS, 0 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)
What Is a Service Mesh?
A service mesh is a dedicated infrastructure layer that manages service-to-service communication within a microservices architecture. It provides networking capabilities – traffic management, security, and observability – without requiring changes to application code.
A service mesh typically consists of two planes:
- Data plane – lightweight proxies (sidecars) deployed alongside each service instance. These proxies intercept all inbound and outbound network traffic, applying routing rules, mTLS encryption, retries, and telemetry collection transparently. Envoy is the most common data plane proxy.
- Control plane – centralized management component that configures the data plane proxies, distributes policies, issues certificates, and aggregates telemetry. Operators interact with the control plane via CLI, API, or dashboard.
Core Capabilities
Service meshes provide capabilities that are difficult to implement consistently across hundreds of microservices:
- Mutual TLS (mTLS) – automatic encryption and identity verification between services using short-lived certificates; zero-trust networking without application changes
- Traffic management – fine-grained routing rules including canary deployments, A/B testing, traffic splitting, retries, timeouts, and circuit breaking
- Observability – automatic collection of request-level metrics (latency, error rates, throughput), distributed tracing, and access logs without instrumenting application code
- Authorization policies – service-level access control defining which services can communicate with which others, based on identity rather than network rules
- Load balancing – intelligent load balancing algorithms (round-robin, least connections, consistent hashing) applied at Layer 7
- Rate limiting – per-service or per-route rate limits to prevent cascading failures
- Fault injection – controlled injection of delays or errors for resilience testing
- Multi-cluster / multi-cloud – extending mesh capabilities across Kubernetes clusters, data centers, or cloud providers
Sidecar vs. Sidecarless
Traditional service meshes deploy a sidecar proxy per pod, which adds resource overhead and operational complexity. Newer approaches aim to reduce this:
- Sidecar model – Envoy proxy injected into each pod (Istio, Linkerd, Consul Connect, Kuma). Proven, mature, but adds memory and CPU per pod.
- Sidecarless / ambient model – shared per-node proxies or eBPF-based interception (Istio Ambient, Cilium Service Mesh). Lower resource overhead but newer and less proven.
- eBPF-based – kernel-level networking that bypasses the traditional proxy entirely for L3/L4 concerns (Cilium). Highest performance but limited to L7 features that still require a proxy.
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
Feature Matrix – Active Open Source
| Feature | Istio | Linkerd | Consul | Cilium | Kuma |
|---|---|---|---|---|---|
| mTLS | Yes | Yes | Yes | Yes* | Yes |
| SPIFFE | Yes | Yes | No | Yes | No |
| AuthZ policies | Yes | Yes | Yes | Yes | Yes |
| L7 routing | Yes | Yes | Yes | Yes | Yes |
| Traffic split | Yes | Yes | Yes | Yes | Yes |
| Fault inject | Yes | No | No | No | Yes |
| Traffic mirror | Yes | No | No | No | No |
| Circuit break | Yes | Auto | Yes | No | Yes |
| Rate limiting | Yes | No | No | No | Yes |
| Dist. tracing | Yes | Yes | Yes | Yes | Yes |
| Multi-cluster | Yes | Yes | Yes | Yes | Yes |
| VM support | Yes | No | Yes | No | No |
| Gateway API | Yes | Yes | No | Yes | No |
* = Cilium supports WireGuard L3 encryption without sidecars; mTLS via Envoy for L7
Feature Matrix – Discontinued / Archived
| Feature | OSM | Traefik Mesh | NGINX Mesh |
|---|---|---|---|
| mTLS | Yes | No | Yes |
| SPIFFE | Yes | No | Yes |
| AuthZ policies | Yes | Yes | Yes |
| L7 routing | Yes | Yes | Yes |
| Traffic split | Yes | Yes | Yes |
| Fault inject | No | No | No |
| Traffic mirror | No | No | No |
| Circuit break | No | No | Yes |
| Rate limiting | No | Yes | Yes |
| Dist. tracing | Yes | Yes | Yes |
| Multi-cluster | No | No | No |
| VM support | No | No | No |
Note: all three projects are discontinued and should not be selected for new deployments.
Feature Matrix – Commercial / Managed
| Feature | Tetrate | Solo.io | AWS App | GCP | AKS |
|---|---|---|---|---|---|
| mTLS | Yes | Yes | Yes | Yes | Yes |
| SPIFFE | Yes | Yes | No | Yes | Yes |
| AuthZ policies | Yes | Yes | No | Yes | Yes |
| L7 routing | Yes | Yes | Yes | Yes | Yes |
| Traffic split | Yes | Yes | Yes | Yes | Yes |
| Fault inject | Yes | Yes | No | Yes | Yes |
| Traffic mirror | Yes | Yes | No | Yes | Yes |
| Multi-cluster | Yes | Yes | Ltd | Yes | Pvw |
| Managed ctrl plane | No | No | Yes | Yes | Yes |
| FIPS | Yes | No | No | No | No |
Ltd = limited (multi-VPC, not multi-region) Pvw = preview / limited support
Architecture Comparison
| Tool | Data Plane | Sidecar | Sidecarless |
|---|---|---|---|
| Istio | Envoy | Yes | Yes (Ambient) |
| Linkerd | linkerd2-proxy (Rust) | Yes | No |
| Consul Connect | Envoy / built-in | Yes | No |
| Cilium | eBPF + Envoy | No* | Yes |
| Kuma | Envoy | Yes | No |
| OSM | Envoy | Yes | No |
| Traefik Mesh | Traefik | No** | Yes** |
| NGINX Mesh | NGINX Plus | Yes | No |
| Tetrate TSB | Envoy (via Istio) | Yes | Yes |
| Solo.io Gloo | Envoy (via Istio) | Yes | Yes |
| AWS App Mesh | Envoy | Yes | No |
| GCP Service Mesh | Envoy (via Istio) | Yes | Yes |
| AKS Istio | Envoy (via Istio) | Yes | Pvw |
* = Cilium uses per-node Envoy for L7; no per-pod sidecar ** = Traefik Mesh used per-node DaemonSet (not sidecar, not eBPF)
Deployment Comparison
| Tool | Type | Platform | K8s | VM |
|---|---|---|---|---|
| Istio | OSS | Any K8s | Yes | Yes |
| Linkerd | OSS | Any K8s | Yes | No |
| Consul | BSL | Any K8s + VM | Yes | Yes |
| Cilium | OSS | Any K8s (CNI) | Yes | No |
| Kuma | OSS | Any K8s + VM | Yes | Yes |
| OSM | Archived | Any K8s | Yes | No |
| Traefik Mesh | Discont. | Any K8s | Yes | No |
| NGINX Mesh | Discont. | Any K8s | Yes | No |
| Tetrate TSB | Commercial | Any K8s | Yes | Yes |
| Solo.io Gloo | Commercial | Any K8s | Yes | No |
| AWS App Mesh | Deprecated | AWS only | Yes | Yes |
| GCP Svc Mesh | Managed | GKE | Yes | No |
| AKS Istio | Managed | AKS | Yes | No |
Licensing Comparison
| Tool | License | Type | Cost |
|---|---|---|---|
| Istio | Apache 2.0 | Open source | Free |
| Linkerd | Apache 2.0 | Open source* | Free |
| Consul | BSL 1.1 | Source-avail | Free** |
| Cilium | Apache 2.0 | Open source | Free |
| Kuma | Apache 2.0 | Open source | Free |
| OSM | Apache 2.0 | Archived | Free |
| Traefik Mesh | Apache 2.0 | Discontinued | Free |
| NGINX Mesh | Proprietary | Discontinued | NGINX Plus |
| Tetrate TSB | Proprietary | Commercial | Contact |
| Solo.io Gloo | Proprietary | Commercial | Contact |
| AWS App Mesh | Proprietary | Deprecated | Free*** |
| GCP Svc Mesh | Proprietary | Managed | GKE Ent. |
| AKS Istio | Proprietary | Managed | Free**** |
* = Buoyant changed stable release model; edge releases remain Apache 2.0 ** = BSL restricts competitive use; enterprise features require paid license *** = no mesh charge; pay for compute/transfer **** = included with AKS at no additional cost
Resource Overhead Comparison
| Tool | Control Plane | Per-Pod Sidecar | Per-Node |
|---|---|---|---|
| Istio | ~500 MB | ~50-100 MB | – |
| Istio Ambient | ~500 MB | – | ~100 MB |
| Linkerd | ~250 MB | ~10-20 MB | – |
| Consul | ~500 MB x3-5 | ~50-100 MB | Agent |
| Cilium | ~200 MB | – | ~300-500 MB |
| Kuma | ~200-400 MB | ~50-100 MB | – |
Lowest per-pod overhead: Linkerd (~10-20 MB) No per-pod overhead: Cilium (eBPF), Istio Ambient (ztunnel per node)
SSO / OIDC Comparison
OIDC is the preferred SSO protocol. The Authentik column shows how each tool integrates with Authentik as the identity provider.
| Tool | OIDC | SAML | Method | Authentik |
|---|---|---|---|---|
| Istio | Yes | No | Kiali OIDC | Direct |
| Linkerd | Proxy | No | oauth2-proxy | Indirect |
| Consul | Yes | No | Auth method | Direct |
| Cilium | Proxy | No | oauth2-proxy | Indirect |
| Kuma | Proxy | No | oauth2-proxy | Indirect |
| Tetrate | Yes | Yes | Native | Direct |
| Solo.io | Yes | Yes | Native | Direct |
| AWS App | IAM | IAM | AWS IAM | Indirect |
| GCP Mesh | IAM | IAM | Google IAM | Indirect |
| AKS Istio | AD | AD | Azure AD | Indirect |
Direct = Authentik OIDC integrates natively Indirect = requires proxy or cloud IAM federation Proxy = requires oauth2-proxy for dashboard SSO
Best SSO support: Tetrate and Solo.io have native OIDC/SAML. Istio (via Kiali) and Consul have native OIDC. Linkerd, Cilium, and Kuma require oauth2-proxy. Cloud-managed meshes use their respective cloud IAM.
CNCF Status
| Tool | CNCF Status | Year |
|---|---|---|
| Istio | Graduated | 2023 |
| Linkerd | Graduated | 2021 |
| Cilium | Graduated | 2023 |
| Kuma | Graduated | 2024 |
| OSM | Archived | 2023 |
| Consul | Not CNCF | – |
| Traefik Mesh | Not CNCF | – |
Tools
13 tools.
AWS App Mesh
AWS App Mesh was a managed service mesh from Amazon Web Services that provided application-level networking using Envoy proxies. It worked across AWS compute services: Amazon ECS, Amazon EKS, AWS Fargate, and Amazon EC2.
License: Proprietary (proprietary) · Kind: service · Deploy: saas · SSO: none
Azure AKS Istio Add-on
The Azure AKS Istio add-on is Microsoft’s managed Istio offering for Azure Kubernetes Service. It provides a Microsoft-supported, managed Istio control plane integrated with AKS, replacing the discontinued Open Service Mesh (OSM) add-on.
License: Proprietary (proprietary) · Kind: service · Deploy: k8s · SSO: none
Cilium Service Mesh
Cilium is an eBPF-based Kubernetes networking, security, and observability platform that includes service mesh capabilities.
License: Apache-2.0 (OSS) · Kind: service · Deploy: k8s · SSO: none
Consul Connect
Consul Connect is the service mesh capability of HashiCorp Consul, a widely used service discovery and configuration platform.
License: LicenseRef-BUSL-1.1 (source-available) · Kind: service · Deploy: k8s · SSO: none
Google Cloud Service Mesh
Google Cloud Service Mesh (formerly Anthos Service Mesh / ASM, and before that Traffic Director + managed Istio) is Google’s managed Istio offering.
License: Proprietary (proprietary) · Kind: web · Deploy: k8s · SSO: OIDC
Istio
Istio is the most widely adopted service mesh in the Kubernetes ecosystem. Originally developed by Google, IBM, and Lyft, it provides a comprehensive platform for managing microservice communication with mTLS, traffic management, observabil…
License: Apache-2.0 (OSS) · Kind: service · Deploy: k8s · SSO: none
Kuma
Kuma is a universal service mesh built on Envoy that supports both Kubernetes and VM-based deployments. Created by Kong Inc. (the company behind Kong API Gateway), Kuma emphasizes ease of use and multi-platform support.
License: Apache-2.0 (OSS) · Kind: web · Deploy: k8s · SSO: none
Linkerd
Linkerd is a lightweight, security-focused service mesh designed for simplicity and low operational overhead. Created by Buoyant (who coined the term “service mesh”), Linkerd was the first service mesh to achieve CNCF graduated status.
License: Apache-2.0 (OSS) · Kind: service · Deploy: k8s · SSO: none
NGINX Service Mesh
NGINX Service Mesh (NSM) was a sidecar-based service mesh from F5/NGINX that used NGINX Plus as its data plane proxy instead of Envoy.
License: Proprietary (proprietary) · Kind: service · Deploy: k8s · SSO: none
Open Service Mesh
Open Service Mesh (OSM) was a lightweight, extensible service mesh that implemented the Service Mesh Interface (SMI) specification.
License: Apache-2.0 (OSS) · Kind: web · Deploy: k8s · SSO: none
Solo.io Gloo Mesh
Gloo Mesh is Solo.io’s enterprise service mesh management platform built on Istio and Envoy, adding multi-cluster management, workspace multi-tenancy, global traffic policies, and an integrated WAF.
License: Proprietary (proprietary) · Kind: service · Deploy: k8s · SSO: none
Tetrate Service Bridge
Tetrate Service Bridge (TSB) is an enterprise service mesh management platform built on top of Istio and Envoy.
License: Proprietary (proprietary) · Kind: service · Deploy: k8s · SSO: none
Traefik Mesh
Traefik Mesh (formerly Maesh) was a lightweight service mesh from Traefik Labs that used Traefik Proxy as both its control plane and data plane instead of Envoy.
License: Apache-2.0 (OSS) · Kind: service · Deploy: k8s · SSO: none
