Freedom251 › Container Networking Software
Network Service Mesh
What Network Service Mesh is
Network Service Mesh connects workloads across clusters and clouds through a hybrid, multi-cloud IP service mesh. Each workload can connect independently to zero or more Network Services, regardless of where it runs. The project says it works with an existing CNI and requires no changes to Kubernetes or workloads. Services can provide connectivity, security, and observability at Layer 3 and above, carrying IP or Ethernet payloads. A client may be a Kubernetes pod, virtual machine, or physical server; clients authenticate independently, currently by SPIFFE ID, and need authorization before attaching. They request and close virtual wires through gRPC and can monitor connection status through a streaming gRPC call. Endpoint selection supports composition, selective composition, topology-aware selection, and scaling from zero. Services may also provide domain-scoped DNS for connected pods. The architecture describes integration with Istio, Linkerd, Consul, or Kuma. The project is a CNCF sandbox project, and its listed plan is free. Its run guide lists Docker, Go, a Kubernetes cluster, and kubectl as prerequisites; most examples require at least two worker nodes.
Who it suits
It suits teams connecting Kubernetes pods, virtual machines, or physical servers across clusters and clouds. Operators should be prepared to meet the listed deployment prerequisites.
What it does well
- Connects workloads across clusters and clouds
- Works with an existing CNI
- Supports IP and Ethernet payloads
- Provides authenticated, authorized service attachments
- Offers topology-aware endpoint selection
What to know first
- Run guide lists Docker, Go, Kubernetes, and kubectl prerequisites
- Most examples require at least two worker nodes
- Clients must be authorized to attach to services
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Network Service Mesh | CNCF sandbox project · pricing not stated | Free |
As networkservicemesh.io lists them, read 7 Oct 2026. The maker's own page has the final word.
Getting started
- Visit https://networkservicemesh.io/.
- Prepare Docker, Go, a Kubernetes cluster, and kubectl.
- Use a Kubernetes environment such as kind, minikube, microk8s, k3s, GKE, or Azure or AWS; bare metal is also listed.
- For most examples, prepare at least two worker nodes.
Verdict
Network Service Mesh provides workload-level connections to network services across clusters and clouds, with gRPC operations and several endpoint-selection options. Its deployment prerequisites and authorization model matter when planning a setup.
Questions
Is Network Service Mesh free?
Yes. It is listed as free and open source.
Which platforms are supported?
Listed platforms include Kubernetes, kind, minikube, microk8s, k3s, GKE, Azure, AWS, and bare metal.
What kinds of workloads can connect?
A client can be a Kubernetes pod, virtual machine, or physical server.
Does it require a particular CNI or changes to Kubernetes?
The project says it works with an existing CNI and requires no changes to Kubernetes or workloads.
Which service mesh projects are mentioned?
The architecture describes using Network Services with Istio, Linkerd, Consul, or Kuma.
Facts from Network Service Mesh's own pages
- Advanced routing
- Endpoint selection supports composition, selective composition, topology-aware selection, and scale from zero. · networkservicemesh.io, 7 Oct 2026
- Cloud integrations
- The run guide lists GKE, Azure and AWS integrations for system tests, and release 1.5.0 reports testing on GKE, AKS and AWS. · networkservicemesh.io, 15 Oct 2026
- CNCF acceptance
- CNCF records Network Service Mesh as accepted at Sandbox maturity on April 11, 2019. · cncf.io, 15 Oct 2026
- CNI compatibility
- NSM keeps the existing Kubernetes CNI for intra-cluster networking and does not require replacing it. · networkservicemesh.io, 15 Oct 2026
- Connection monitoring
- The MonitorConnection gRPC service streams connection events for selected connections. · networkservicemesh.io, 15 Oct 2026
- Core capabilities
- The project describes L3 zero trust, per-workload granularity, and per-workload connectivity, security and observability. · networkservicemesh.io, 15 Oct 2026
- Deployment requirements
- The run guide lists Docker, Go, a Kubernetes cluster, and kubectl as prerequisites; it says most examples require at least two worker nodes. · networkservicemesh.io, 7 Oct 2026
- DNS
- A Network Service may provide DNS scoped to specified domains or subdomains for connected pods. · networkservicemesh.io, 7 Oct 2026
- DNS and IPAM
- NSM can provide per-network-service DNS, inject interfaces into pods, assign endpoint-provided addresses and add optional routes while avoiding cluster-prefix collisions. · networkservicemesh.io, 15 Oct 2026
- Documentation depth
- The examples catalog includes inter-domain, Istio, OpenTelemetry, OPA, IPv6, dual-stack, Jaeger, DNS, webhook, SR-IOV, OVS, resilience and topology-aware examples. · networkservicemesh.io, 15 Oct 2026
- Examples and integrations
- The project lists examples for OpenTelemetry, OPA, IPv6, dual stack, Jaeger, DNS, SR-IOV, and Open vSwitch. · networkservicemesh.io, 7 Oct 2026
- Forwarder backends
- The reference components include VPP and Open vSwitch forwarders for creating network interfaces. · networkservicemesh.io, 15 Oct 2026
- Governance
- Project governance prioritizes community over product or company and says contributors participate as individuals. · networkservicemesh.io, 15 Oct 2026
- Identity and authorization
- Clients are independently authenticated, currently by SPIFFE ID, and must be authorized to attach to a Network Service. · networkservicemesh.io, 7 Oct 2026
- Independent event description
- A 2020 NSMCon prospectus characterized NSM as community-driven, CNCF sandbox software extending IP reachability to multi-cluster, legacy, on-premises and public-cloud workloads. · networkservicemesh.io, 15 Oct 2026
- Install prerequisites
- The run guide lists Docker, Go, kubectl and a Kubernetes cluster; kind, minikube, microk8s and k3s are suggested cluster options. · networkservicemesh.io, 15 Oct 2026
- Inter-domain registry
- Registry domains can be independent, and clients and endpoints may connect across domains subject to policy. · networkservicemesh.io, 15 Oct 2026
- Kubernetes admission
- The Kubernetes admission webhook injects NSM clients into annotated pods or into pods in annotated namespaces. · networkservicemesh.io, 15 Oct 2026
- Kubernetes fit
- The project says it requires no changes to Kubernetes or workloads and works with an existing CNI. · networkservicemesh.io, 7 Oct 2026
- License
- The public Network Service Mesh GitHub repositories shown are licensed Apache-2.0. · github.com, 15 Oct 2026
- Limit: latency and ingress concerns
- The same analysis reports that service-mesh users can encounter added communication latency and may need separate Kubernetes ingress controllers for external traffic. · techtarget.com, 15 Oct 2026
- Limit: operational complexity
- TechTarget's independent service-mesh analysis warns that mesh infrastructure adds data and control planes, increases container-environment complexity and can add compute overhead. · techtarget.com, 15 Oct 2026
- Network Service Manager
- NSMgr discovers services and endpoints, processes client requests, stores valid connections and can optionally act as a registry. · networkservicemesh.io, 15 Oct 2026
- Network service payloads
- Network Services can carry IP or Ethernet payloads, with IP as the default when unspecified. · networkservicemesh.io, 15 Oct 2026
Where Network Service Mesh stands on Freedom251
- Container Networking Software#2 of 28
- Service Mesh Platforms#2 of 22