This guide walks you through creating a sidecarless AI demo on Alibaba Cloud Service Mesh ASM, covering environment setup, multi‑model serving with KServe, PVC storage, InferenceService configuration, business service deployment, gateway and waypoint creation, traffic routing rules, and OIDC single sign‑on integration.
This article explains the evolution from classic sidecar‑based service mesh to Istio's Ambient sidecarless architecture, details ASM's control‑plane and data‑plane separation, L4 ztunnel and L7 Waypoint proxies, traffic flow, serverless components, and real‑world benefits such as reduced resource usage and operational overhead.
The article by delphisfang offers a concise, step‑by‑step guide to mastering Istio’s locality‑aware routing, explaining the three‑evidence learning method, the priority algorithm, required DestinationRule and outlier detection settings, how Envoy discovers locality, and tips for simplifying the Pilot‑Envoy mesh architecture.
To upgrade an Istio service mesh without overloading the cluster or causing downtime, the author recommends using Kubernetes’s built‑in kubectl rollout restart for each deployment—scaling replicas up then deleting old pods or simply invoking the command in a scripted loop—to safely perform a rolling restart of all sidecar‑proxied pods.
This article explains how the automotive platform accelerated its cloud‑native service‑mesh transformation by integrating Opentelemetry, Prometheus, and Grafana, then details the configuration and practical use of Grafana's unified alerting module—including installation, data source setup, alert rule definition, contact points, message templates, and silencing—to achieve comprehensive observability and automated incident response.
This guide explains what sidecars are in Kubernetes, why they matter, the challenges they introduce, and how the new sidecar KEP in Kubernetes 1.28—introducing an Always RestartPolicy for init containers—formalizes sidecars as first‑class API objects, reshaping service‑mesh implementations and operational practices.
This article outlines Weibo's massive user‑scale challenges and presents a comprehensive high‑availability solution that combines capacity planning, distributed caching, micro‑service isolation, cross‑language RPC, service‑mesh governance, multi‑datacenter disaster recovery, containerization, and hybrid‑cloud scaling to ensure reliable service delivery.
The article analyzes how private keys for workloads uploaded via Istio Ingress gateways can be exposed in plaintext, stored in memory, and extracted using tools like OpenSSL and GDB, and discusses mitigation strategies such as Intel SGX‑based protection.
Developers and architects can compare Apache Dubbo, Spring Cloud, gRPC, and Istio across architecture, performance, scalability, and governance, gaining clear guidance on selecting the right micro‑service framework and understanding each tool’s strengths, protocol support, and integration patterns for enterprise‑grade cloud‑native applications.
This article examines the challenges of setting effective rate‑limiting thresholds for massive cloud‑native services, compares TPS and concurrency metrics, proposes stress‑testing and historical‑data‑ARMA forecasting methods, and presents a practical system that delivers reliable limits for both node‑wide and per‑service protection.
Aeraki Mesh 1.4.0 (codename Heshun) released on August 13, 2023 adds Istio 1.18.x compatibility, removes Envoy Dubbo/Thrift filters, introduces extensive changelog updates, lists contributors from major tech firms, and provides reference links to the official site and GitHub repository.
This article explains how service mesh complements Kubernetes by providing advanced traffic management, observability, and security for microservices, discusses common distributed‑system fallacies and service‑governance challenges, compares Istio with FloMesh, and explores future trends such as Wasm sidecars, ambient mesh, and eBPF.
This guide explains how Alibaba Cloud Service Mesh ASM enables comprehensive observability for cloud‑native applications by configuring telemetry for logs, metrics, and distributed tracing, offering best‑practice recommendations, YAML examples, and integration with Prometheus, ARMS, and external tracing tools.
This article explains the difficulties of performing gray releases in microservice architectures and presents full‑link gray release concepts, two implementation strategies—environment isolation and traffic routing—along with practical solutions using Istio, service‑discovery agents, tracing baggage, and Alibaba Cloud MSE integrated with ZadigX.
This article walks through the step‑by‑step transformation of a simple online supermarket from a single‑node monolith to a fully fledged microservice architecture, highlighting the motivations, common pitfalls, component choices, monitoring, tracing, logging, resilience patterns, testing strategies, and the trade‑offs of frameworks versus service mesh.
This article traces the evolution of service mesh from its early concepts through microservice 1.0 and 2.0, analyzes the shortcomings of Envoy‑based sidecars, and explores future directions such as Go‑based data planes, WASM plugins, eBPF/VPP acceleration, QUIC transport, and on‑demand xDS delivery.
This article explains the role of API gateways in microservice architectures, outlines their four core functions, discusses design priorities such as high performance, availability, and scalability, and compares major open‑source gateway solutions like OpenResty, Kong, Zuul, and Spring Cloud Gateway.
Aeraki Mesh 1.3.0 (code‑named Dragonboat) adds Istio 1.16.x compatibility, introduces connection multiplexing, enables MetaProtocol routing on gateways, expands Dubbo service governance options, provides Redis traffic management, and migrates official images to GitHub Packages, with a detailed changelog and configuration examples.
An online supermarket startup evolves its simple monolithic website into a fully distributed microservice architecture, detailing each transformation stage, the challenges encountered—such as code duplication, database bottlenecks, deployment complexity—and the solutions like service decomposition, monitoring, tracing, circuit breaking, and service mesh.
This article explores the evolution of load‑balancing architectures from Alibaba’s early systems to modern micro‑service meshes, detailing DNS, hardware, and software solutions, common algorithms, and real‑world case studies such as Double‑11, China Railway 12306, WeChat red packets, and Douyin, highlighting performance, scalability, and reliability considerations.
This article explains MOSN v1.5.0's latency‑based load‑balancing algorithm, analyzes the sources of latency in distributed systems, describes mitigation techniques such as PeakEWMA and P2C, and presents a realistic simulation that shows the algorithm’s superiority over Round Robin and Least Request.
This article explains the three main use cases of API gateways—Open API platforms, microservice gateways, and API service management platforms—describes their position in enterprise architecture, outlines practical deployment scenarios, compares competing solutions, and provides criteria for choosing the right gateway for performance, scalability, extensibility, and cloud deployment.
This article walks through the evolution of a simple online supermarket from a monolithic architecture to a fully fledged microservice system, highlighting the challenges, component choices, database splitting, monitoring, tracing, logging, gateway, service discovery, resilience patterns, testing strategies, and the trade‑offs of using a custom framework versus a service mesh.
This comprehensive guide introduces Dubbo, a high‑performance Java RPC framework, covering its core concepts, architecture, configuration methods, load‑balancing and fault‑tolerance strategies, underlying communication mechanisms, and extension points, helping developers build robust distributed applications.
This article provides a comprehensive overview of the Kubernetes Gateway API, covering the constraints of Ingress resources, L4 routing methods, the role of SIG-NETWORK, reasons behind the API's development, and a preview of deeper technical details.
This article details the collaborative effort between Intel and F5 to redesign and implement dual‑stack networking support in Istio 1.17, covering the background challenges, new RFC design, key Envoy changes, step‑by‑step experimental setup, listener and endpoint modifications, and ways for the community to contribute.
This article breaks down the core concepts of Kubernetes—including its master‑worker architecture, pod scheduling, etcd storage, service exposure, scaling mechanisms, and controller interactions—through a series of clear questions and illustrated answers to help beginners grasp the platform’s complexity.
Viaduct, Airbnb’s data‑oriented service mesh built on GraphQL, replaces traditional procedural meshes by centralizing a schema that routes queries across thousands of micro‑services, enabling fine‑grained data access, serverless derived fields, automatic schema propagation, and improved observability, now handling most of Airbnb’s API traffic.
This article details the evolution of 58 Tongcheng's deep learning inference platform—from the initial WPAI‑based architecture to a cloud‑native, Istio‑powered design—covering its background, technical challenges, architectural redesign, traffic‑management features, adaptive rate limiting, model warm‑up, and observability improvements.
The article outlines Ctrip’s microservice journey from its 2013 inception, detailing the evolution of its frameworks, the complexities of operating multiple stacks, the challenges faced, and the design of a progressive cloud‑native service‑mesh architecture built on Istio, Envoy, and custom operators.
Facing rapid growth and complex service interactions, Huolala transitioned from a simple PHP‑based architecture to a self‑developed microservice framework, combining data and control planes, custom RPC protocols, and robust governance, while explaining why existing solutions like Dubbo and Istio were unsuitable.
This guide explains why and how to combine Tencent's open‑source Polaris service‑governance platform with the high‑performance dubbogo Go RPC framework, covering architecture, registration, discovery, dynamic routing and rate‑limiting, complete with configuration snippets and practical code examples.
This article explains Istio’s core networking concepts, detailing how sidecar and init containers are injected into a Kubernetes cluster, the roles of the data and control planes, and provides step‑by‑step commands and YAML examples for manual and automatic sidecar injection.
This article introduces Service Mesh fundamentals, traces its evolution to Istio, explains the Proxyless Mesh architecture that eliminates sidecar proxies, and provides a step‑by‑step Spring Cloud demo showing how to enable xDS‑based, sidecar‑free communication across multi‑language microservices on Alibaba Cloud MSE.
This article explains what an API gateway is, why it is needed in micro‑service architectures, outlines core design ideas such as routing, service registration, load balancing, resilience and security, distinguishes traffic and business gateways, and compares major open‑source implementations like OpenResty, Kong, Zuul 1/2 and Spring Cloud Gateway.
The article explains why CTOs should adopt cloud‑native—gaining elasticity, cost savings, and rapid delivery—while acknowledging trade‑offs like provider lock‑in and security, and it details core technologies such as micro‑services, containers, Kubernetes orchestration, service meshes, observability tools, and DevOps practices for building resilient, scalable applications.
This tutorial explains the background of the Kubernetes Gateway API, compares it with the traditional Ingress API, and provides a hands‑on walkthrough for installing the Gateway API CRDs, configuring Istio to use a Gateway resource, exposing a sample httpbin service, updating routes, and cleaning up the environment.
This article explores Huolala’s evolution of application architecture—from a single monolithic system through RPC and SOA to microservices and service mesh—detailing the challenges, technical trade‑offs, and framework selections such as Dubbo, Spring Cloud, and Istio for robust backend governance.
This article explains the fundamental concepts of API gateways, why they are essential in micro‑service architectures, outlines core design ideas such as routing, load balancing, resilience and security, and compares popular open‑source implementations like OpenResty, Kong, Zuul and Spring Cloud Gateway.
The article reviews how Ant Financial’s Service Mesh has evolved after its double‑11 rollout, detailing the implementation of link encryption, adaptive rate limiting, fine‑grained traffic steering, and self‑healing mechanisms that improve security, performance, and reliability across large‑scale microservice deployments.
This article reviews how Ant Financial’s Service Mesh has matured since its 2019 Double‑11 rollout, detailing the design and implementation of link encryption, adaptive rate limiting, fine‑grained traffic steering, and service self‑healing, and explains the operational value these capabilities bring to large‑scale microservice systems.
The article explains why microservice governance is essential, introduces the OpenSergo project and its collaboration with ShardingSphere to create a unified, language‑agnostic standard for database governance, and provides concrete abstractions and YAML examples for implementing traffic, fault‑tolerance, and security policies.
This article provides an in‑depth overview of API gateways, explaining their basic concepts, design principles, key features such as request routing, service registration, load balancing, resilience and security, and compares popular gateway solutions like OpenResty, Kong, Zuul and Spring Cloud Gateway for microservice architectures.
This article explains how the Intel istio‑tcpip‑bypass plugin leverages eBPF to bypass the host TCP/IP stack for intra‑node pod communication, provides environment setup, step‑by‑step deployment commands, and shows benchmark results that demonstrate 40‑80% latency reduction and throughput improvement.
This article explains what an API gateway is, why it is needed in micro‑service architectures, outlines core design ideas such as request routing, service registration, load balancing, resilience and security, and compares major open‑source gateways like OpenResty, Kong, Zuul 1/2 and Spring Cloud Gateway.
This article walks through the step‑by‑step transformation of a simple online supermarket from a monolithic web app to a fully‑featured microservice architecture, covering common pitfalls, component choices, monitoring, tracing, logging, service discovery, fault‑tolerance, testing, and deployment strategies.
This article walks through the evolution of a simple online supermarket from a monolithic website to a fully split microservice architecture, highlighting the challenges encountered—such as code duplication, database bottlenecks, and operational complexity—and presenting practical solutions like service decomposition, monitoring, tracing, gateway control, service discovery, circuit breaking, rate limiting, testing strategies, and the use of service meshes.
Google donated Istio to the CNCF, which was accepted as an incubating project, introducing the experimental Ambient Mesh mode while retaining sidecar support, and the article outlines Istio's architecture, history, community contributions, and industry perspectives on this cloud‑native milestone.
This article explains how to prepare Linkerd for production use by covering high‑availability deployment, Helm chart installation, Prometheus metric handling, external Prometheus integration, multi‑cluster communication, and additional operational best‑practices such as resource tuning and security considerations.
This article presents a comprehensive backend architecture guide covering microservice fundamentals, domain‑driven design, gateway patterns, service registration, configuration centers, observability pillars, service mesh options, and a detailed comparison of major message‑queue technologies.
Istio's ambient mesh introduces a shared‑node ztunnel and optional waypoint proxies to provide zero‑trust security and optional L7 features without sidecar injection, reducing invasiveness, resource waste, and operational complexity while maintaining full mesh functionality.
The article compares monolithic, clustered, and distributed architectures, examines the differences between Spring Cloud, Kubernetes, and Istio, discusses Spring Boot on K8s, and explains the benefits of Service Mesh and sidecar proxies for modern microservice deployments.
This article explains the transition from monolithic to microservice architecture using an online supermarket example, highlights the problems caused by rapid, unplanned scaling, and presents systematic solutions such as service decomposition, database sharding, monitoring, tracing, gateway, service discovery, circuit breaking, testing, and service mesh adoption.
By registering foreign clusters to the Tencent Distributed Cloud Center and linking them with Cloud Connect Network, the guide shows how to use Tencent Cloud Service Mesh to create a unified ingress gateway, configure DNS and Istio virtual services, and route traffic across multiple accounts and clusters securely.
Apache Dubbo 3.1.0 introduces native Service Mesh support, an error‑code troubleshooting guide, Fastjson2 serialization, single‑port multi‑protocol handling, and full compatibility with Dubbo 3.0, providing a lighter data‑plane and a more cohesive control‑plane for cloud‑native applications.
This article explains ByteDance’s evolution from monolithic services to a multi‑runtime microservice architecture, introduces four sidecar runtime models, details the ByteRuntime design with Mesh Pilot and governance layers, and shares performance‑boosting techniques such as PGO while comparing ByteRuntime with DAPR.
This article walks through the evolution of an online supermarket from a simple monolithic web app to a fully fledged microservice architecture, detailing the motivations, design decisions, component breakdown, common pitfalls, and essential practices such as monitoring, tracing, logging, service discovery, resilience patterns, testing, and the role of service meshes.
Consul 1.13 introduces a Kubernetes CNI plugin, enhanced Envoy troubleshooting CLI, upgraded terminating gateways, and a preview of cluster peering, enabling organizations to reduce operational complexity, securely connect services at scale, and integrate service mesh capabilities directly into their workflows.
The article explains how Intuit manages hundreds of Kubernetes clusters using multi‑control‑plane architectures and Admiral to automate Istio service‑mesh configuration, illustrating the challenges of large‑scale microservice deployment and sharing a domestic bank’s experience with similar cloud‑native adoption.
This article explores modern service governance in the microservice era, comparing traditional sidecar‑based Service Mesh solutions like Istio with emerging eBPF‑driven meshes and RSocket Broker architectures, highlighting their design, performance, operational, and security trade‑offs.
This guide explains how to connect Dubbo services to Aeraki Mesh using Dubbo2Istio or direct ServiceEntry definitions, covering configuration, environment variables, Kubernetes deployment, and client adjustments to achieve comprehensive L7 traffic routing, load balancing, and rate limiting within an Istio service mesh.
This tutorial demonstrates how to install Aeraki and Istio, deploy Dubbo sample services, define ServiceEntry and MetaRouter resources, route traffic to a primary version, mirror traffic to a secondary version, verify logs, and explain the underlying MetaProtocol proxy mechanism for traffic mirroring.
The article examines the evolution from monolithic to distributed systems, contrasts Spring Cloud with Kubernetes and Istio, explains how service‑mesh concepts like sidecar proxies decouple business logic from infrastructure, and discusses migration paths and the advantages of non‑intrusive, language‑agnostic platforms.
This tutorial walks through installing Aeraki Mesh and sample Dubbo/Thrift services, creating a MetaRouter resource to add custom request headers, verifying the changes via sidecar logs, and explains how Aeraki translates MetaRouter rules into MetaProtocol Proxy configurations delivered through its internal RDS server.
This tutorial explains how to install Aeraki Mesh sample applications, forward ports to Prometheus and Grafana, and use these tools to query and visualize L7 protocol metrics for Dubbo and Thrift services within an Istio service mesh.
This tutorial demonstrates how to install Aeraki Mesh, view its default Round Robin load balancing, and configure a Consistent Hash algorithm for Dubbo services using Istio DestinationRule metadata, then verifies the behavior and explains the underlying RDS routing configuration.
The article interviews Ant Group’s Trusted Native team, detailing their cloud‑native infrastructure roadmap—including middleware mesh, SOFAStack, secure container runtimes like Kata and MOSN, confidential‑computing platforms such as Occlum, HyperEnclave and KubeTEE—while highlighting open‑source strategy, security considerations, and productization efforts.
This article provides an extensive overview of microservice architecture, tracing its evolution from monolithic to distributed services, detailing the advantages and drawbacks of each stage, and presenting a practical technology stack—including service discovery, API gateways, containerization, orchestration, logging, monitoring, and CI/CD—to help engineers design, implement, and operate modern cloud‑native systems.
This tutorial walks through installing Aeraki Mesh and Istio on Kubernetes, deploying a fake Thrift service, configuring an Istio DestinationRule for outlier detection, and verifying that failed endpoints are automatically ejected to prevent cascade failures.
This tutorial explains how to set up Aeraki Mesh's global rate limiting for Dubbo and Thrift services in an Istio service mesh, covering the deployment of a rate‑limit server, configuration of rate‑limit rules, enabling limits via MetaRouter, and verifying the behavior with command‑line tools.
This tutorial demonstrates how to install Aeraki Mesh, use its MetaRouter CRD to configure local rate limiting for MetaProtocol services such as Dubbo and Thrift, apply per‑service and conditional limits, and view the generated sidecar proxy configuration in a Kubernetes environment.
The article examines the evolution from monolithic to distributed architectures, compares Spring Cloud, Kubernetes, and Istio, explains how service mesh and sidecar proxies enable language‑agnostic microservices, and argues that Kubernetes‑based solutions increasingly surpass Spring Cloud in flexibility, scalability, and operational independence.
This tutorial explains the fundamentals of service mesh, outlines Istio's architecture and core components, walks through installing Istio on Kubernetes, demonstrates a sample microservice deployment with traffic‑management, security, and observability features, and discusses when to adopt a service mesh and its alternatives.
This comprehensive article reviews backend architectural concepts such as microservices design, service mesh, observability pillars, gateway patterns, service registration, configuration centers, and a detailed comparison of message‑queue technologies, providing practical guidance for architects and engineers.
This tutorial demonstrates how to install Aeraki Mesh, use its MetaRouter CRD to achieve request‑level load balancing, attribute‑based routing, and weighted traffic splitting for Dubbo and Thrift services in an Istio service mesh, including the underlying configuration principles and example commands.
This article introduces Aeraki Mesh, a CNCF sandbox project that extends Istio by providing a non‑intrusive, scalable framework to manage traffic for any layer‑7 protocol—including Dubbo, Thrift, Redis, and Kafka—through its MetaProtocol architecture and dynamic routing capabilities.
This article explores Tencent’s evolution from monolithic LAMP/MVC stacks to a container‑based microservice architecture, detailing the open‑source Polaris Mesh service mesh, Spring Cloud Tencent framework, and their gateway, naming, and configuration components, while highlighting deployment benefits and practical usage examples.
This article walks through creating a simple Spring Boot microservice using gRPC, packaging it with Maven, containerizing it with Docker, and deploying both the server and client to a Kubernetes cluster with Istio sidecar injection, demonstrating how Istio removes service‑mesh logic from business code and enables seamless multi‑language microservice communication.
The article examines the evolution from monolithic to distributed architectures, contrasts Spring Cloud with Kubernetes and Istio, and explains how service mesh and sidecar proxies enable language‑agnostic, non‑intrusive microservice deployments in modern cloud‑native environments.
This comprehensive guide explains Kubernetes' networking model, covering core concepts such as network namespaces, virtual Ethernet pairs, pod-to-pod and pod-to-service communication, CIDR routing, NAT, iptables, IPVS, DNS, and how traffic flows between pods, services, and the external Internet.
This article explores the evolution of cloud computing into its second half, defining cloud native through CNCF's perspective, tracing its history from early Linux containers and Cgroups to Docker and Kubernetes, and detailing the core technologies—containers, service mesh, microservices, immutable infrastructure, and declarative APIs—while highlighting their practical benefits for rapid iteration, automated deployment, and efficient, scalable applications.
This article examines the evolution from large monolithic applications to distributed micro‑service systems, comparing Spring Cloud with Kubernetes and Istio, discussing the role of Service Mesh, and evaluating the benefits and trade‑offs of using Spring Boot on K8s versus a full Service Mesh solution.
This article examines the evolution from monolithic applications to distributed micro‑service architectures, compares Spring Cloud with Kubernetes and Istio, discusses the role of Spring Boot on K8s, and explains the value of Service Mesh and sidecar proxies for decoupling business logic from infrastructure.
This article chronicles Bilibili’s transition from a PHP monolith to a Go‑based bilizone monolith, its subsequent decomposition into microservices, the adoption of Backend‑for‑Frontend (BFF) layers, and the eventual consolidation into a unified API gateway that streamlines routing, security, and traffic management across the platform.
IDC’s recent China Cloud‑Native Market Analysis reports that Ant Group has become one of the most comprehensive domestic cloud‑native technology providers, with widespread enterprise adoption, major investment in cluster scheduling, mixed‑deployment, and Service Mesh, and ongoing open‑source and commercial initiatives driving industry innovation.
This article chronicles Alibaba's three‑stage evolution of Envoy Gateway—from the 1.0 incubation that powered Double‑11 traffic, through the 2.0 growth phase adding north‑south routing and hybrid‑cloud support, to the mature 3.0 release that unifies traffic and micro‑service gateways with high performance and community‑driven extensions.
This guide explains how to leverage Zadig v1.11.0’s environment self‑test mode to create isolated developer sub‑environments for large‑scale microservice projects, using Istio’s traffic routing and SkyWalking tracing, detailing prerequisite components, configuration of a PiggyMetrics Spring Boot example, and step‑by‑step verification via Kubernetes commands and curl requests.
This article explains the concept of cloud native, its definition by the CNCF, the history of containers and Docker, the role of Kubernetes as the orchestration backbone, and related technologies such as micro‑services, service mesh, immutable infrastructure and declarative APIs, highlighting their business value and evolution.
The Fourth Techo TVP Developer Conference highlighted current cloud‑native adoption, FinOps cost‑optimization, distributed‑cloud strategies, and maturity models on Day 1, then showcased practical best‑practice case studies—from automotive edge computing to service‑mesh migration, hybrid‑cloud PaaS evolution, observability standards, and high‑performance API‑gateway deployments—on Day 2.
This article outlines Huolala's journey through five architectural stages—monolith, RPC, SOA, microservices, and service mesh—detailing the motivations, challenges, and technical choices such as Dubbo, Spring Cloud, and Istio that shaped its high‑availability, cloud‑native backend platform.
This article explains the concept of Proxyless Service Mesh, compares it with traditional sidecar‑based meshes, outlines its advantages and drawbacks, and details how the Dubbo-go framework integrates with Istio to provide interface‑level service discovery, traffic management, and cloud‑native tooling.
To meet rapid business growth, the team at 收钱吧 evolved its testing environments through several generations—from isolated physical setups to a Kubernetes‑based multi‑lane system powered by Istio and custom operators—significantly reducing resource usage, speeding deployments, and improving scalability and flexibility.
This article examines how Service Mesh and API Gateway differ in responsibilities, explores the east‑west versus north‑south traffic concepts, discusses two implementation philosophies, and traces the evolving integration of sidecars, BFF, and unified gateway solutions in modern microservice architectures.
This article examines how Service Mesh and API Gateway differ in function and deployment, explores the philosophical debate over east‑west versus north‑south traffic when a gateway accesses internal services, and traces the evolving integration of sidecars, BFF layers, and cloud‑native architectures.
This whitepaper explains Google’s BeyondProd security framework, detailing how cloud‑native microservice architectures replace traditional perimeter models with zero‑trust principles, mutual authentication, service mesh, and automated tooling such as ALTS, Binary Authorization, and gVisor to protect workloads across shared infrastructure.
This article examines the performance limitations of Kubernetes pod, service, and network‑policy layers built on the kernel Netfilter framework, explores eBPF‑based alternatives such as tc‑ebpf and Cilium, describes a Terway‑with‑eBPF implementation, and presents benchmark results showing significant latency and scalability improvements.
This article explains the concept of cloud native, its origins in CNCF, the evolution of containers, Docker and Kubernetes, the role of micro‑services, service mesh, immutable infrastructure and declarative APIs, and highlights the key benefits such as rapid iteration, automated deployment and independent scalability.
Zhihu describes its journey from a custom Kodor RPC framework to a full Istio service‑mesh deployment, detailing the background challenges, Consul‑based service discovery, migration strategy, traffic management, platform tooling, and the numerous operational pitfalls encountered along the way.
This article examines how eBPF can enhance service‑mesh data planes, compares four deployment models—including sidecar, node‑shared, service‑account‑shared, and micro‑proxy architectures—and evaluates each model’s memory, isolation, security, and upgrade trade‑offs while emphasizing Envoy’s continued L7 responsibilities.
The article examines how eBPF and WebAssembly are being explored as high‑performance, kernel‑level alternatives to traditional sidecar proxies in service mesh architectures, discussing their benefits, limitations, and the ongoing debate among major mesh providers.
