Network Service Mesh
Network Service Mesh is an open-source project for connecting workloads across clusters and clouds through a hybrid, multi-cloud IP service mesh.
What Network Service Mesh is
Network Service Mesh is an open-source project for connecting workloads across clusters and clouds through a hybrid, multi-cloud IP service mesh. Individual workloads can connect to zero or more Network Services regardless of where they run. The project says it works with an existing CNI and does not require changes to Kubernetes or workloads. Network Services can provide connectivity, security, and observability at Layer 3 and above, carrying IP or Ethernet payloads. Clients may be Kubernetes pods, virtual machines, or physical servers. They authenticate independently, currently with SPIFFE IDs, and must be authorized before attaching. Clients use gRPC to request and close virtual wires and can monitor connection status through a streaming call. Endpoint selection supports composition, selective composition, topology-aware selection, and scale from zero. A Network Service may provide DNS scoped to specified domains or subdomains for connected pods. The architecture describes use alongside Istio, Linkerd, Consul, or Kuma. The CNCF sandbox project is free. Its run guide lists Docker, Go, Kubernetes, and kubectl as prerequisites; most examples need at least two worker nodes.
Good
- Works with an existing CNI without workload changes.
- Supports IP and Ethernet payloads.
- Clients authenticate independently and require authorization.
- Provides gRPC operations and connection-status monitoring.
- Supports topology-aware endpoint selection.
Watch out
- Run guide prerequisites include Docker, Go, Kubernetes, and kubectl.
- Most examples require at least two worker nodes.
- Clients need authorization to attach to a Network Service.
Who it suits
It suits teams connecting Kubernetes pods, virtual machines, or physical servers across clusters and clouds. It is relevant to operators who want per-workload Network Services and can meet the listed deployment prerequisites.
Verdict
Network Service Mesh is aimed at cross-cluster and cross-cloud workload networking with service-level controls. Its deployment prerequisites and client authorization requirements are worth accounting for before use.
Plans and prices
From Network Service Mesh's own pricing page, checked 7 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Network Service Mesh | Free | CNCF sandbox project · pricing not stated |
The facts
Each one read from Network Service Mesh's own pages, with the date it was checked.
What it does
- Advanced routing
- Endpoint selection supports composition, selective composition, topology-aware selection, and scale from zero.checked 7 Oct 2026
- Cloud integrations
- The run guide lists GKE, Azure and AWS integrations for system tests, and release 1.5.0 reports testing on GKE, AKS and AWS.checked 15 Oct 2026
- CNCF acceptance
- CNCF records Network Service Mesh as accepted at Sandbox maturity on April 11, 2019.checked 15 Oct 2026
- CNI compatibility
- NSM keeps the existing Kubernetes CNI for intra-cluster networking and does not require replacing it.checked 15 Oct 2026
- Connection monitoring
- The MonitorConnection gRPC service streams connection events for selected connections.checked 15 Oct 2026
- Core capabilities
- The project describes L3 zero trust, per-workload granularity, and per-workload connectivity, security and observability.checked 15 Oct 2026
- Deployment requirements
- The run guide lists Docker, Go, a Kubernetes cluster, and kubectl as prerequisites; it says most examples require at least two worker nodes.checked 7 Oct 2026
- DNS
- A Network Service may provide DNS scoped to specified domains or subdomains for connected pods.checked 7 Oct 2026
- DNS and IPAM
- NSM can provide per-network-service DNS, inject interfaces into pods, assign endpoint-provided addresses and add optional routes while avoiding cluster-prefix collisions.checked 15 Oct 2026
- Documentation depth
- The examples catalog includes inter-domain, Istio, OpenTelemetry, OPA, IPv6, dual-stack, Jaeger, DNS, webhook, SR-IOV, OVS, resilience and topology-aware examples.checked 15 Oct 2026
- Examples and integrations
- The project lists examples for OpenTelemetry, OPA, IPv6, dual stack, Jaeger, DNS, SR-IOV, and Open vSwitch.checked 7 Oct 2026
- Forwarder backends
- The reference components include VPP and Open vSwitch forwarders for creating network interfaces.checked 15 Oct 2026
- Governance
- Project governance prioritizes community over product or company and says contributors participate as individuals.checked 15 Oct 2026
- Identity and authorization
- Clients are independently authenticated, currently by SPIFFE ID, and must be authorized to attach to a Network Service.checked 7 Oct 2026
- Independent event description
- A 2020 NSMCon prospectus characterized NSM as community-driven, CNCF sandbox software extending IP reachability to multi-cluster, legacy, on-premises and public-cloud workloads.checked 15 Oct 2026
- Install prerequisites
- The run guide lists Docker, Go, kubectl and a Kubernetes cluster; kind, minikube, microk8s and k3s are suggested cluster options.checked 15 Oct 2026
- Inter-domain registry
- Registry domains can be independent, and clients and endpoints may connect across domains subject to policy.checked 15 Oct 2026
- Kubernetes admission
- The Kubernetes admission webhook injects NSM clients into annotated pods or into pods in annotated namespaces.checked 15 Oct 2026
- Kubernetes fit
- The project says it requires no changes to Kubernetes or workloads and works with an existing CNI.checked 7 Oct 2026
- License
- The public Network Service Mesh GitHub repositories shown are licensed Apache-2.0.checked 15 Oct 2026
- Limit: latency and ingress concerns
- The same analysis reports that service-mesh users can encounter added communication latency and may need separate Kubernetes ingress controllers for external traffic.checked 15 Oct 2026
- Limit: operational complexity
- TechTarget's independent service-mesh analysis warns that mesh infrastructure adds data and control planes, increases container-environment complexity and can add compute overhead.checked 15 Oct 2026
- Network Service Manager
- NSMgr discovers services and endpoints, processes client requests, stores valid connections and can optionally act as a registry.checked 15 Oct 2026
- Network service payloads
- Network Services can carry IP or Ethernet payloads, with IP as the default when unspecified.checked 15 Oct 2026
Alternatives to Network Service Mesh
- 1
Antrea
Free planOpen sourceAPILinuxSelf-hostedWindows7.2Free plan - 2
Aviatrix Kubernetes Firewall
WebSelf-hosted6.2 - 3
kube-network-policies
Free planLinuxSelf-hosted6.2Free plan - 4
Calico Open Source
Free planLinuxSelf-hostedWindows6.1Free plan - 5
Cilium
Free planLinuxSelf-hosted6.0Free plan - 6
CNI Plugins
Free planLinuxWindows6.0Free plan