- Home
- Container Networking Software
- Network Service Mesh
Network Service Mesh
What it is
Network Service Mesh is an open-source hybrid and multi-cloud IP service mesh for connecting workloads across clusters and clouds. It lets each workload attach to Network Services independently of where it runs, and those services can provide connectivity, security, and observability at Layer 3 and above, using IP or Ethernet payloads. Clients may be Kubernetes pods, virtual machines, or physical servers. They authenticate independently, currently with SPIFFE IDs, and require authorization before attaching. The project says it works with an existing CNI without requiring changes to Kubernetes or workloads. Clients use gRPC to open and close virtual wires and can stream connection status. Routing offers composition, selective composition, topology-aware selection, and scale from zero; services may also provide scoped DNS for connected pods. The architecture describes integration with Istio, Linkerd, Consul, and Kuma. Its free, open-source plan is listed as free. The run guide lists Docker, Go, a Kubernetes cluster, and kubectl as prerequisites, with most examples requiring at least two worker nodes.
For and against
For
- Free, open-source CNCF sandbox project.
- Works with an existing CNI without Kubernetes changes.
- Supports IP and Ethernet payloads.
- Provides authenticated, authorized workload connections.
- Includes topology-aware endpoint selection and scoped DNS.
Against
- Run guide prerequisites include Docker, Go, Kubernetes, and kubectl.
- Most examples require at least two worker nodes.
- Clients require authorization before attaching to a service.
The verdict
Network Service Mesh centers on per-workload connections to network services across clusters and clouds, with multiple routing and integration options. Its listed plan is free, but its run guide specifies several deployment prerequisites.
Who it suits
It suits teams connecting workloads across Kubernetes clusters, clouds, or mixed infrastructure, including pods, virtual machines, and physical servers. It may fit teams seeking network services that can provide connectivity, security, and observability.
Plans and prices
Network Service Mesh
CNCF sandbox project · pricing not stated
Read 7 Oct 2026 · networkservicemesh.io
On the record
- Advanced routing
- Endpoint selection supports composition, selective composition, topology-aware selection, and scale from zero.networkservicemesh.io · read 7 Oct 2026
- Cloud integrations
- The run guide lists GKE, Azure and AWS integrations for system tests, and release 1.5.0 reports testing on GKE, AKS and AWS.networkservicemesh.io · read 15 Oct 2026
- CNCF acceptance
- CNCF records Network Service Mesh as accepted at Sandbox maturity on April 11, 2019.cncf.io · read 15 Oct 2026
- CNI compatibility
- NSM keeps the existing Kubernetes CNI for intra-cluster networking and does not require replacing it.networkservicemesh.io · read 15 Oct 2026
- Connection monitoring
- The MonitorConnection gRPC service streams connection events for selected connections.networkservicemesh.io · read 15 Oct 2026
- Core capabilities
- The project describes L3 zero trust, per-workload granularity, and per-workload connectivity, security and observability.networkservicemesh.io · read 15 Oct 2026
- Deployment requirements
- The run guide lists Docker, Go, a Kubernetes cluster, and kubectl as prerequisites; it says most examples require at least two worker nodes.networkservicemesh.io · read 7 Oct 2026
- DNS
- A Network Service may provide DNS scoped to specified domains or subdomains for connected pods.networkservicemesh.io · read 7 Oct 2026
- DNS and IPAM
- NSM can provide per-network-service DNS, inject interfaces into pods, assign endpoint-provided addresses and add optional routes while avoiding cluster-prefix collisions.networkservicemesh.io · read 15 Oct 2026
- Documentation depth
- The examples catalog includes inter-domain, Istio, OpenTelemetry, OPA, IPv6, dual-stack, Jaeger, DNS, webhook, SR-IOV, OVS, resilience and topology-aware examples.networkservicemesh.io · read 15 Oct 2026
- Examples and integrations
- The project lists examples for OpenTelemetry, OPA, IPv6, dual stack, Jaeger, DNS, SR-IOV, and Open vSwitch.networkservicemesh.io · read 7 Oct 2026
- Forwarder backends
- The reference components include VPP and Open vSwitch forwarders for creating network interfaces.networkservicemesh.io · read 15 Oct 2026
- Governance
- Project governance prioritizes community over product or company and says contributors participate as individuals.networkservicemesh.io · read 15 Oct 2026
- Identity and authorization
- Clients are independently authenticated, currently by SPIFFE ID, and must be authorized to attach to a Network Service.networkservicemesh.io · read 7 Oct 2026
- Independent event description
- A 2020 NSMCon prospectus characterized NSM as community-driven, CNCF sandbox software extending IP reachability to multi-cluster, legacy, on-premises and public-cloud workloads.networkservicemesh.io · read 15 Oct 2026
- Install prerequisites
- The run guide lists Docker, Go, kubectl and a Kubernetes cluster; kind, minikube, microk8s and k3s are suggested cluster options.networkservicemesh.io · read 15 Oct 2026
- Inter-domain registry
- Registry domains can be independent, and clients and endpoints may connect across domains subject to policy.networkservicemesh.io · read 15 Oct 2026
- Kubernetes admission
- The Kubernetes admission webhook injects NSM clients into annotated pods or into pods in annotated namespaces.networkservicemesh.io · read 15 Oct 2026
