Cello CNI vs Network Service Mesh
Cello CNI
github.comNetwork Service Mesh
networkservicemesh.ioSide by side
| Figure | Cello CNI | Network Service Mesh |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Container Networking Software | 7.9 (#6) | 8.3 (#3) |
| Deployment requirements | The README specifies Volcengine ECS with kernel 4.19 or later, notes testing on veLinux 1.0 with kernel 5.10, and recommends kubeadm for Kubernetes installation. | The run guide lists Docker, Go, a Kubernetes cluster, and kubectl as prerequisites; it says most examples require at least two worker nodes. |
| License | Cello is distributed under the Apache 2.0 license. | The public Network Service Mesh GitHub repositories shown are licensed Apache-2.0. |
| Purpose | Cello is a Kubernetes CNI plugin based on the Volcengine VPC network that lets cluster workloads communicate within the VPC. | Network Service Mesh is a hybrid and multi-cloud IP service mesh for connecting workloads across clusters and clouds. |
Plans
In their own words
Network Service Mesh
Network Service Mesh connects workloads across clusters and clouds through a hybrid, multi-cloud IP service mesh. Each workload can connect independently to zero or more Network Services, regardless of where it runs. The project says it works with an existing CNI without requiring changes to Kubernetes or workloads. Services can provide connectivity, security, and observability at Layer 3 and above, carrying IP or Ethernet payloads.
Clients may be Kubernetes pods, virtual machines, or physical servers. They authenticate independently, currently using SPIFFE IDs, and need authorization to attach. Clients request and close virtual wires over gRPC and can monitor connection status through a streaming call. Endpoint selection offers composition, selective composition, topology awareness, and scale from zero. A service may also provide domain-scoped DNS for connected pods. The architecture describes integration with Istio, Linkerd, Consul, and Kuma. Network Service Mesh is a CNCF sandbox project and is free and open source. Its run guide lists Docker, Go, a Kubernetes cluster, and kubectl as prerequisites; most examples require at least two worker nodes.