Flomesh Service Mesh

Flomesh Service Mesh (FSM) is an open-source service mesh for managing traffic and governing microservices running on Kubernetes. It uses the Flomesh Pipy proxy, automatically injecting it as a sidecar into onboarded applications. Traffic capabilities include shifting, ingress and egress, and Kubernetes Gateway API features. FSM supports HTTP, TCP, gRPC, and MQTT traffic. For service security, it enables mutual TLS and fine-grained access policies. Certificate management can use Tresor, cert-manager, or HashiCorp Vault. Prometheus and Grafana integrations are marked stable in the documentation, while Jaeger distributed tracing is beta. Integration guides also cover Dapr and service discovery registries such as Consul, Eureka, and Nacos. FSM supports x86 and ARM architectures and multi-cluster connectivity through the MCS API, though multicluster is marked alpha. It is self-hosted and free. Installation requires Kubernetes 1.19 or later; listed version 1.1 support covers Kubernetes 1.19 through 1.24.

FSM provides traffic controls, service security, and integrations for Kubernetes microservices as a free, self-hosted product. Check the Kubernetes version requirement and the documented lifecycle limits for features such as multicluster and Jaeger tracing.

FSM may suit teams running microservices on Kubernetes that need traffic management, service policies, and mutual TLS. It is a self-hosted option for teams prepared to meet its Kubernetes requirement.

Flomesh Service Mesh is a self-hosted Kubernetes service mesh built around the Flomesh Pipy sidecar proxy. It is best for teams that want open-source traffic governance and service-to-service security across varied protocols and CPU architectures. The feature breadth is useful, but incomplete Gateway API coverage, an alpha multicluster feature, and operational security considerations make compatibility checks essential.

Overview

FSM automatically injects Pipy as a sidecar into onboarded applications, putting traffic policy and governance alongside each workload. It supports HTTP, TCP, gRPC, and MQTT, so it can cover more than HTTP-centric microservices. Documentation supports x86 and ARM architectures, and the deployment model is self-hosted on Kubernetes or OpenShift rather than a hosted control plane.

Installation requires Kubernetes 1.19 or later. The documented 1.1 release supports Kubernetes 1.19 through 1.24, so organizations on newer clusters should verify version compatibility before standardizing. The setup guide provides CLI downloads for GNU/Linux and macOS.

Key features

• Traffic control: Traffic shifting plus ingress and egress management address routine rollout and boundary-control work. FSM also exposes Kubernetes Gateway API capabilities, but ReferenceGrant is unsupported and several Gateway API resources are only partially supported. That is a material constraint for teams building around the full Gateway API model.
• Service security: Mutual TLS encrypts and authenticates service-to-service connections, while fine-grained access policies control permitted communication. Certificate handling can use FSM's Tresor implementation, cert-manager, or HashiCorp Vault, giving platform teams multiple documented integration paths.
• Observability: Prometheus and Grafana integrations are stable, making those established monitoring tools the safer choice for production visibility. Jaeger distributed tracing is documented as beta, so tracing-dependent operations should account for a less mature lifecycle.
• Ecosystem integration: Guides cover Dapr, Prometheus, and discovery through Consul, Eureka, and Nacos registries. These integrations matter most when FSM must fit an existing platform rather than replace it.
• Multicluster: FSM uses the Kubernetes MCS API for cross-cluster service connectivity, but multicluster is marked alpha. It is therefore more suitable for evaluation or carefully bounded deployments than for assuming a settled, central production capability.
• Runtime prerequisites: The application prerequisites state that the init container runs as root and adds the NET_ADMIN capability. Security-conscious operators should include those privileges in their admission, hardening, and review process.

Pricing

FSM is open source and free. The listed plan, Flomesh Service Mesh (FSM), costs nothing and is described as an open-source service mesh for Kubernetes. There are no paid tiers, seat charges, trial periods, renewal terms, or published usage quotas in the plan information. That makes it a straightforward fit for teams prepared to operate self-hosted infrastructure; it does not provide a paid support or managed-service tier in the stated offering.

Platforms

FSM runs in Kubernetes and OpenShift environments, with Linux, macOS, and self-hosted platform coverage. Its documented x86 and ARM support helps heterogeneous clusters, while the CLI downloads target GNU/Linux and macOS. The Kubernetes 1.19-or-later requirement and the stated 1.1 support range through Kubernetes 1.24 are important deployment gates.

Who it's for

Choose FSM when your platform team wants sidecar-based policy, mTLS, certificate integrations, and protocol coverage without licensing fees, and is comfortable owning Kubernetes operations. It is especially relevant for clusters that already use Prometheus, Grafana, Dapr, or one of the documented discovery registries. Look elsewhere if your rollout depends on complete Gateway API resource support, production-ready multicluster functionality, or an operator model that avoids root and NET_ADMIN in initialization.

Pros and cons

Pros

• Free and open source: There is no stated license charge or tiered quota to budget.
• Broad protocol coverage: HTTP, TCP, gRPC, and MQTT support can serve mixed application estates.
• Flexible certificate integrations: Tresor, cert-manager, and HashiCorp Vault provide documented choices for certificate management.
• Stable monitoring integrations: Prometheus and Grafana align with common Kubernetes observability stacks.
• x86 and ARM support: The documented architectures suit mixed hardware environments.

Cons

• Gateway API incompleteness: ReferenceGrant is unavailable and several resources are partial.
• Alpha multicluster status: MCS connectivity exists, but its lifecycle is not mature enough for every critical cross-cluster design.
• Privilege requirements: The init container requires root and NET_ADMIN, increasing hardening work.
• Version constraints: Installation starts at Kubernetes 1.19, while the stated 1.1 support range ends at 1.24.
• Beta tracing: Jaeger integration is less settled than the stable Prometheus and Grafana paths.

Alternatives

Kong Gateway is the better direction when a paid product with a free trial and gateway-focused deployment is preferred; its free trial lasts 30 days with no gateway limits and 30 days of analytics retention.

Traefik Mesh suits teams seeking another free, open-source Kubernetes mesh with a stated Kubernetes 1.11-plus requirement, CoreDNS or KubeDNS, and Helm v3.

Buoyant Enterprise for Linkerd is worth considering when freemium commercial backing matters; its open-source plan is always free to try and permits production use at any scale for companies with fewer than 50 employees.

Istio is a free open-source alternative for teams wanting a widely established service-mesh option across Linux, macOS, and self-hosted deployments.

Kuma is a free open-source control plane that also supports VMs and bare metal, not only Kubernetes.

Linkerd is a free Apache 2.0-licensed open-source mesh for Kubernetes.

VMware Workstation Pro is a free Linux and Windows virtualization product rather than a service mesh.

AWS App Mesh has no additional App Mesh charge, but proxy resource consumption is billed through AWS.

Verdict

FSM is a strong candidate for Kubernetes teams that want no-cost, self-hosted traffic policy, mTLS, and broad protocol and certificate integration. Choose it when your cluster versions and Gateway API usage fit its documented boundaries and you can accept sidecar and initialization privileges. Look elsewhere when complete Gateway API support, mature multicluster networking, or a managed commercial operating model is the priority.