Kmesh: The Kernel-Native Service Mesh
Shriira Press
A service mesh data plane that lives in the Linux kernel — no sidecars, near-zero overhead, governed by eBPF.
Welcome to Kmesh: The Kernel-Native Service Mesh.
Kmesh is a high-performance, sidecarless service mesh data plane built on eBPF and the programmable Linux kernel. Where traditional meshes intercept every connection with a per-pod proxy, Kmesh sinks traffic governance down into the kernel itself, removing the proxy hops that add latency and consume memory and CPU on every workload. The result is a mesh that delivers load balancing, encryption, authorization, and observability with a fraction of the overhead, while staying compatible with the Istio control plane through the xDS protocol. This book begins with the problem sidecars created and the eBPF foundations that make a kernel-native alternative possible. It then walks through Kmesh's architecture and its two operating modes — Kernel-Native and Dual-Engine — before covering how it integrates with Istio, how its data path forwards and accelerates traffic, how it handles L4 and L7 governance, how it secures and observes the mesh, and finally how to adopt and operate it in practice. Along the way we keep to real component names, real CRDs, and real commands.
This title is part of the ShriIra library and is free to read in full, right here — our small contribution to making world-class knowledge easy to reach.
A note on reading it: open the Contents menu at the top of the reader to jump between chapters, use the Aa menu to set a comfortable text size, theme (light, sepia, or night), and single- or two-page layout. Your place is saved automatically, so you can always pick up where you left off.
We hope it serves you well.
— Shriira Press