News for hackers. Stuff that matters.

A comment on eBPF will help solve service mesh by getting rid of sidecars. Parent comment

Re:eBPF will help solve service mesh by getting rid of sidecars by tgraf on Thursday December 09, 2021 @12:09PM (#29500015)
One of the methods that Cilium (which implements this eBPF-based service mesh idea) uses to implementation authentication between workloads is Wireguard. It does exactly what you describe above.

In addition it can also be used to enforce based on service specific keys/certificates as well.

[ Parent | on HN ]
Re:eBPF will help solve service mesh by getting rid of sidecars by allset_ on Thursday December 09, 2021 @12:39PM (#29500433)
Isn't the Wireguard implementation in Cilium between nodes only, not workloads (pods)?
[ Parent | on HN ]
Re:eBPF will help solve service mesh by getting rid of sidecars by tgraf on Thursday December 09, 2021 @12:57PM (#29500674)
It can do both. It can authenticate and encrypt all traffic between nodes which then also encrypts all traffic between the pods running on those pods. This is great because it also covers pod to node and all control plane traffic. The encryption can also use specific keys for different services to authenticate and encrypt pod to pod individually.
[ Parent | on HN ]