Calico Open Source vs Network Service Mesh

Calico Open Source provides networking, network security, and observability for Kubernetes across multi-cloud, hybrid-cloud, and on-premises environments. It supports container, virtual machine, and bare-metal workloads with a shared security policy framework. The policy engine implements Kubernetes network policy features including AdminNetworkPolicy and BaselineAdminNetworkPolicy. Policies can use tiers, deny and log actions, NetworkSets, and cluster-wide global rules; Staged Policies allow teams to assess behavior before applying enforcement. Listed data planes include eBPF, iptables, nftables, Windows, and VPP. Whisker provides a visual way to view flow logs and analyze network communication. Calico can also manage WireGuard tunnels to encrypt pod traffic between Kubernetes nodes. Calico Ingress Gateway provides traffic control, load balancing, and ingress policy enforcement. The free plan includes unlimited clusters, with in-memory data retention and community-driven support and maintenance. Tigera describes deployments ranging from 10 to 10,000 or more nodes.

Network Service Mesh connects workloads across clusters and clouds through a hybrid, multi-cloud IP service mesh. Each workload can connect independently to zero or more Network Services, regardless of where it runs. The project says it works with an existing CNI without requiring changes to Kubernetes or workloads. Services can provide connectivity, security, and observability at Layer 3 and above, carrying IP or Ethernet payloads.

Clients may be Kubernetes pods, virtual machines, or physical servers. They authenticate independently, currently using SPIFFE IDs, and need authorization to attach. Clients request and close virtual wires over gRPC and can monitor connection status through a streaming call. Endpoint selection offers composition, selective composition, topology awareness, and scale from zero. A service may also provide domain-scoped DNS for connected pods. The architecture describes integration with Istio, Linkerd, Consul, and Kuma. Network Service Mesh is a CNCF sandbox project and is free and open source. Its run guide lists Docker, Go, a Kubernetes cluster, and kubectl as prerequisites; most examples require at least two worker nodes.