Cilium vs Netris

Cilium is an open-source, cloud-native system for providing, securing, and observing network connectivity between workloads using eBPF. Its networking capabilities include CNI, Layer 4 load balancing, Cluster Mesh, kube-proxy replacement, BGP, service mesh, Gateway API, IPv6, host firewall, and ingress. Network policies can enforce identity-aware rules from L3 through L7, including DNS- and HTTP-aware filtering. Security features include runtime protection and transparent encryption of managed host and endpoint traffic using IPsec, WireGuard, or ztunnel; ztunnel support is marked beta. For visibility, Cilium lists service maps, metrics and tracing export, network flow logs, and protocol visibility. Hubble, built on Cilium and eBPF, provides visibility into service communication and behavior. Documentation describes Prometheus and Grafana integrations and Kubernetes support for services including GKE, AKS, EKS, OpenShift, RKE, k3s, and Alibaba ACK. Its container image requires AMD64 or AArch64 hosts running Linux kernel 5.10 or later, or an equivalent kernel such as 4.18 on RHEL 8.10. For environments above 500 nodes, the quick installation guide directs readers to large-environment guidance or specific datapath modes.

Netris is a network automation, abstraction, and multi-tenancy platform for AI infrastructure operators, including neoclouds, sovereign cloud operators, and AI factories. It spans Ethernet, InfiniBand, NVLink, DPUs, virtual networks, and edge networks. The Netris Controller uses algorithms to configure VRFs, VXLANs, BGP, and other settings with closed-loop assurance. It runs in the customer environment on dedicated bare-metal hosts, with a minimum of three nodes. Engineers can use a web console, REST API, or Kubernetes integration; the controller also works with Terraform and documents an NVIDIA UFM integration for InfiniBand. That plugin can automate PKey configuration and optionally create SHARP reservations for server clusters. Netris documents tenant isolation through VRFs, VXLANs, ACLs, InfiniBand PKeys, and NVLink fabric partitions. API requests, including GUI activity, are logged. If the controller is unreachable, devices continue forwarding traffic and enforcing existing policies, while new changes and telemetry pause. Pricing is on request.