Traefik Mesh

Traefik Mesh is an open-source service mesh for Kubernetes, with self-hosted deployment and a listed price of free. It routes traffic through proxy endpoints on each node and runs its controller in a dedicated pod, without sidecar containers. Services stay outside the mesh until they are accessed through Traefik Mesh service names, allowing teams to add them selectively. Configuration uses annotations or Service Mesh Interface (SMI) objects. Traffic controls include retries, circuit breakers, rate limits, and SMI traffic splitting; ACL mode can require authorization between resources. Examples cover HTTP and TCP services. A debugging API is available through the controller pod rather than as an exposed service. Installation uses a Helm chart and requires Kubernetes, CoreDNS or KubeDNS, and Helm v3. The documentation recommends conformant Kubernetes environments and reports use on AWS, GKE, Azure, and DigitalOcean. Its compatibility page lists Kubernetes 1.21, 1.22, and 1.23 as the latest supported minor versions. Traefik Mesh does not provide mutual TLS or implement the SMI Traffic Metrics specification.

Traefik Mesh offers selective service enrollment and several traffic controls in a sidecarless Kubernetes architecture. Check the listed Kubernetes compatibility and the absence of mutual TLS and SMI Traffic Metrics against your requirements.

Traefik Mesh suits teams running Kubernetes that want to add services to a mesh selectively and configure traffic policies. It may fit environments using Helm and CoreDNS or KubeDNS.

Traefik Mesh is a free, self-hosted service mesh for Kubernetes, aimed at teams that want to bring services into mesh routing selectively. Its sidecarless design and traffic controls make it a focused option, though its documented Kubernetes compatibility and security limits narrow where it fits.

Overview

Services stay outside the mesh until they are accessed through Traefik Mesh service names. That lets teams introduce mesh routing service by service. Traffic passes through proxy endpoints on each node, with a dedicated pod managing the mesh; avoiding sidecars keeps proxy containers out of application pods, while still requiring teams to install and operate the mesh infrastructure.

Services can be configured with annotations or SMI objects. Traefik Mesh supports the Service Mesh Interface, but does not implement SMI Traffic Metrics, so it is a weaker fit for teams that need that specification's metrics support.

Key features

Traffic routing and policy

Traefik Mesh supports HTTP and TCP service examples, along with retries, circuit breakers, rate limits, traffic types and SMI traffic splitting. ACL mode can require authorization between resources using SMI TrafficTarget resources. Those controls give operators several ways to shape service traffic, but they do not provide mutual TLS; teams that require encrypted, mutually authenticated service connections should choose a mesh that supports it.

Debugging and deployment

A built-in debugging API is accessed through the controller pod rather than exposed as a service. That keeps the API tied to the controller, but reaching it requires access to that pod. Installation uses a Helm chart and requires Kubernetes, CoreDNS or KubeDNS, and Helm v3. The documentation recommends conformant Kubernetes environments and reports use on AWS, GKE, Azure and DigitalOcean.

Pricing

Traefik Mesh: free. The open-source plan is suitable for teams able to operate their own Kubernetes infrastructure and meet the DNS and Helm prerequisites. It has no stated seat or usage quota, and does not include mutual TLS or SMI Traffic Metrics support.

Platforms

Traefik Mesh is self-hosted software for Kubernetes, with API and Linux listed as platforms. The compatibility page identifies Kubernetes 1.21, 1.22 and 1.23 as its latest three supported minor versions; general functionality is not guaranteed for older versions. Although the installation prerequisites begin at Kubernetes 1.11+, teams should check the compatibility range against their cluster before adopting it.

Who it's for

Traefik Mesh suits Kubernetes operators who want selective service enrollment, sidecarless routing and policy controls without paying for the open-source software. It is a poor fit for deployments that require mutual TLS, depend on SMI Traffic Metrics or need confidence in Kubernetes versions beyond the documented compatibility range.

Pros and cons

Pros

• Services join only when accessed through Traefik Mesh service names, giving teams a controlled path to mesh adoption.
• Sidecarless routing avoids adding proxy containers to each application pod.
• Retries, circuit breakers, rate limits, traffic splitting and ACLs provide meaningful traffic management options.
• The open-source plan costs nothing and supports self-hosted Kubernetes deployments.

Cons

• No mutual TLS leaves out a core security control for teams that require authenticated, encrypted service-to-service traffic.
• No SMI Traffic Metrics support limits its usefulness in environments built around that specification.
• The documented latest supported minor versions are 1.21 through 1.23, which may not match a cluster's Kubernetes version.
• Helm v3 and CoreDNS or KubeDNS are prerequisites, adding requirements to deployment.

Alternatives

For teams comparing mesh options, the Service Mesh Platforms directory is a useful starting point. Kong Gateway is worth considering when a 30-day trial with no Gateway limits and 30 days of analytics retention suits the evaluation. Choose Buoyant Enterprise for Linkerd if its open-source option, always free to try and available for production at any scale for companies with fewer than 50 employees, matches your needs. Flomesh Service Mesh, Istio and Linkerd are also free, open-source service mesh options; Linkerd specifically requires Kubernetes. Kuma is a free open-source control plane for Kubernetes, VMs and bare metal, making it relevant when workloads span those environments. AWS App Mesh has no additional charge for the service itself, with costs tied to AWS resources consumed by its proxy. VMware Workstation Pro is another free option for Windows and Linux hosts on 64-bit Intel or AMD PCs.

Verdict

Choose Traefik Mesh if you run Kubernetes and want a free, self-hosted way to route selected services without sidecars, with retries, circuit breakers, rate limits and SMI-based controls. Its selective enrollment is the clearest reason to adopt it; the lack of mutual TLS and the narrow documented Kubernetes compatibility range are the strongest reasons to look elsewhere.