Search papers, labs, and topics across Lattice.
This paper introduces Meshlib, a sidecar-less service mesh extension that leverages Cilium's eBPF-based data plane to enforce Layer-7 security policies directly within application processes. By eliminating sidecar proxies, Meshlib significantly reduces latency and resource overhead while maintaining robust security guarantees, addressing a critical challenge in microservice architectures. Evaluation against existing solutions like Istio and Linkerd demonstrates that Meshlib achieves the lowest end-to-end latency while enforcing a comprehensive set of security policies across multiple services.
Meshlib slashes service mesh latency by eliminating sidecar proxies without sacrificing security, achieving the lowest end-to-end latency in its class.
Service meshes facilitate service-to-service communication and enforce security policies in microservice architectures. However, they often depend on per-pod sidecar proxies, which introduce significant latency and resource overhead due to redundant application-layer parsing on every request. Eliminating sidecars without compromising security guarantees remains a central challenge. To address this, we introduce Meshlib, a sidecar-less service mesh extension built on Cilium as a control-plane extension. Meshlib incorporates a non-intrusive application-bound library that enforces Layer-7 policies within the application process, while delegating transport-level identity and routing to Cilium's eBPF-based data plane. This separation of responsibilities removes sidecar-induced latency and maintains the security semantics of the service mesh. The architecture remains fully interoperable with unmodified services, enabling incremental adoption within existing deployments. We evaluate Meshlib against Istio, Linkerd, and unmodified Cilium on the TrainTicket benchmark, enforcing 126 security policies across 37 services and show that it achieves the lowest end-to-end latency of all evaluated configurations with comparable resource overhead.
