Skip to content
SPECIFICTION
Get listed

Network Service Mesh

networkservicemesh.io

Free plan Open source LinuxAPISelf-hosted
Visit networkservicemesh.io
Spec score 8.3 #3 of 28 in Container Networking Software

What it is

Network Service Mesh connects workloads across clusters and clouds through a hybrid, multi-cloud IP service mesh. Each workload can connect independently to zero or more Network Services, regardless of where it runs. The project says it works with an existing CNI without requiring changes to Kubernetes or workloads. Services can provide connectivity, security, and observability at Layer 3 and above, carrying IP or Ethernet payloads.

Clients may be Kubernetes pods, virtual machines, or physical servers. They authenticate independently, currently using SPIFFE IDs, and need authorization to attach. Clients request and close virtual wires over gRPC and can monitor connection status through a streaming call. Endpoint selection offers composition, selective composition, topology awareness, and scale from zero. A service may also provide domain-scoped DNS for connected pods. The architecture describes integration with Istio, Linkerd, Consul, and Kuma. Network Service Mesh is a CNCF sandbox project and is free and open source. Its run guide lists Docker, Go, a Kubernetes cluster, and kubectl as prerequisites; most examples require at least two worker nodes.

Spec sheet

What it does
Network Service Mesh connects individual Kubernetes pods and other workloads to network services across clusters, clouds and runtime domains.Read 15 Oct 2026 · networkservicemesh.io
Purpose
Network Service Mesh is a hybrid and multi-cloud IP service mesh for connecting workloads across clusters and clouds.Read 7 Oct 2026 · networkservicemesh.io
License
The public Network Service Mesh GitHub repositories shown are licensed Apache-2.0.Read 15 Oct 2026 · github.com
Advanced routing
Endpoint selection supports composition, selective composition, topology-aware selection, and scale from zero.Read 7 Oct 2026 · networkservicemesh.io
Cloud integrations
The run guide lists GKE, Azure and AWS integrations for system tests, and release 1.5.0 reports testing on GKE, AKS and AWS.Read 15 Oct 2026 · networkservicemesh.io
CNCF acceptance
CNCF records Network Service Mesh as accepted at Sandbox maturity on April 11, 2019.Read 15 Oct 2026 · cncf.io
CNI compatibility
NSM keeps the existing Kubernetes CNI for intra-cluster networking and does not require replacing it.Read 15 Oct 2026 · networkservicemesh.io
Connection monitoring
The MonitorConnection gRPC service streams connection events for selected connections.Read 15 Oct 2026 · networkservicemesh.io
Core capabilities
The project describes L3 zero trust, per-workload granularity, and per-workload connectivity, security and observability.Read 15 Oct 2026 · networkservicemesh.io
Deployment requirements
The run guide lists Docker, Go, a Kubernetes cluster, and kubectl as prerequisites; it says most examples require at least two worker nodes.Read 7 Oct 2026 · networkservicemesh.io
DNS
A Network Service may provide DNS scoped to specified domains or subdomains for connected pods.Read 7 Oct 2026 · networkservicemesh.io
DNS and IPAM
NSM can provide per-network-service DNS, inject interfaces into pods, assign endpoint-provided addresses and add optional routes while avoiding cluster-prefix collisions.Read 15 Oct 2026 · networkservicemesh.io
Documentation depth
The examples catalog includes inter-domain, Istio, OpenTelemetry, OPA, IPv6, dual-stack, Jaeger, DNS, webhook, SR-IOV, OVS, resilience and topology-aware examples.Read 15 Oct 2026 · networkservicemesh.io
Examples and integrations
The project lists examples for OpenTelemetry, OPA, IPv6, dual stack, Jaeger, DNS, SR-IOV, and Open vSwitch.Read 7 Oct 2026 · networkservicemesh.io
Forwarder backends
The reference components include VPP and Open vSwitch forwarders for creating network interfaces.Read 15 Oct 2026 · networkservicemesh.io
Governance
Project governance prioritizes community over product or company and says contributors participate as individuals.Read 15 Oct 2026 · networkservicemesh.io
Identity and authorization
Clients are independently authenticated, currently by SPIFFE ID, and must be authorized to attach to a Network Service.Read 7 Oct 2026 · networkservicemesh.io
Independent event description
A 2020 NSMCon prospectus characterized NSM as community-driven, CNCF sandbox software extending IP reachability to multi-cluster, legacy, on-premises and public-cloud workloads.Read 15 Oct 2026 · networkservicemesh.io
Install prerequisites
The run guide lists Docker, Go, kubectl and a Kubernetes cluster; kind, minikube, microk8s and k3s are suggested cluster options.Read 15 Oct 2026 · networkservicemesh.io
Inter-domain registry
Registry domains can be independent, and clients and endpoints may connect across domains subject to policy.Read 15 Oct 2026 · networkservicemesh.io
Kubernetes admission
The Kubernetes admission webhook injects NSM clients into annotated pods or into pods in annotated namespaces.Read 15 Oct 2026 · networkservicemesh.io
Kubernetes fit
The project says it requires no changes to Kubernetes or workloads and works with an existing CNI.Read 7 Oct 2026 · networkservicemesh.io
Limit: latency and ingress concerns
The same analysis reports that service-mesh users can encounter added communication latency and may need separate Kubernetes ingress controllers for external traffic.Read 15 Oct 2026 · techtarget.com
Limit: operational complexity
TechTarget's independent service-mesh analysis warns that mesh infrastructure adds data and control planes, increases container-environment complexity and can add compute overhead.Read 15 Oct 2026 · techtarget.com
Network Service Manager
NSMgr discovers services and endpoints, processes client requests, stores valid connections and can optionally act as a registry.Read 15 Oct 2026 · networkservicemesh.io
Network service payloads
Network Services can carry IP or Ethernet payloads, with IP as the default when unspecified.Read 15 Oct 2026 · networkservicemesh.io
Network services
Network Services can provide connectivity, security, and observability at Layer 3 and above.Read 7 Oct 2026 · networkservicemesh.io
Notable news
Cisco reported in December 2019 that NSM had become a CNCF sandbox project in April 2019 and had more than 40 contributors at that time.Read 15 Oct 2026 · newsroom.cisco.com
Operations API
Clients use gRPC calls to request and close virtual wires, and can monitor connection status through a streaming gRPC call.Read 7 Oct 2026 · networkservicemesh.io
Payloads
A Network Service can carry IP or Ethernet payloads.Read 7 Oct 2026 · networkservicemesh.io
Per-workload networking
It lets individual workloads connect to zero or more Network Services independently of where they run.Read 7 Oct 2026 · networkservicemesh.io
Praise: cross-domain connectivity
Cisco described NSM as a tool intended to simplify connectivity paradigms for cloud-native application development and support robust Kubernetes networking.Read 15 Oct 2026 · newsroom.cisco.com
Project status
The project is a Cloud Native Computing Foundation sandbox project.Read 15 Oct 2026 · cncf.io
Public API
The NetworkService gRPC API exposes Request and Close calls for creating and closing connections.Read 15 Oct 2026 · networkservicemesh.io
Rating on G2
Not displayed out of 5 from 0 Network Service Mesh reviews; the Linux Foundation seller page includes Network Service Mesh as a profile filter but shows no corresponding product entry.Read 15 Oct 2026 · g2.com
Rating on TrustRadius
Not displayed out of 10 from 0 Network Service Mesh reviews; the TrustRadius service-mesh category page lists 21 other products without Network Service Mesh.Read 15 Oct 2026 · trustradius.com
Registry API
The registry gRPC services provide Register, Find and Unregister operations for Network Services and endpoints.Read 15 Oct 2026 · networkservicemesh.io
Service mesh integrations
The architecture describes using Network Services with Istio, Linkerd, Consul, or Kuma.Read 7 Oct 2026 · networkservicemesh.io
SR-IOV
Release 1.0.0 added SR-IOV connection mechanisms using either vfio or a kernel interface backed by SR-IOV.Read 15 Oct 2026 · networkservicemesh.io
Topology-aware scale
The 1.0.0 release added topology-aware endpoint selection and the ability to spawn endpoints on demand when no suitable endpoint exists.Read 15 Oct 2026 · networkservicemesh.io
Traditional mesh integration
The documentation describes NSM as complementary to Istio, Linkerd, Consul and Kuma, allowing workloads to connect to those L7 meshes through NSM.Read 15 Oct 2026 · networkservicemesh.io
Virtual wires
NSM creates virtual wires between clients and endpoints; endpoints can be pods, VMs, physical-network elements or other packet-processing targets.Read 15 Oct 2026 · networkservicemesh.io
WireGuard
Release 1.0.0 made WireGuard the default transport for IP payloads.Read 15 Oct 2026 · networkservicemesh.io
Workload changes
The homepage says NSM requires no changes to Kubernetes or application workloads.Read 15 Oct 2026 · networkservicemesh.io
Workload identity
The concepts documentation says clients are independently authenticated using SPIFFE IDs and must be authorized before attachment.Read 15 Oct 2026 · networkservicemesh.io
Workload types
A client can be a Kubernetes pod, virtual machine, or physical server.Read 7 Oct 2026 · networkservicemesh.io

Plans and prices

Network Service Mesh Free CNCF sandbox project · pricing not stated Read 7 Oct 2026 · networkservicemesh.io

Every Network Service Mesh plan and price →

Strong points and limits

Strong points

  • Connects workloads across clusters and clouds.
  • Carries IP or Ethernet payloads.
  • Works with an existing CNI.
  • Supports multiple workload types.
  • Free and open source.

Limits

  • Run guide requires Docker, Go, Kubernetes, and kubectl.
  • Most examples require at least two worker nodes.
  • Authorization is required to attach to services.

Who it suits

It suits teams connecting workloads across clusters or clouds, including environments with Kubernetes, virtual machines, or physical servers. Operators should be prepared to meet the listed deployment prerequisites.

Verdict

Network Service Mesh specifies workload connectivity, client authorization, routing options, and operational gRPC calls. Its listed run prerequisites and worker-node requirement are worth checking before trying the examples.

Where Specifiction places it

Alternatives to Network Service MeshAll alternatives →