CNI Plugins vs Network Service Mesh

CNI Plugins is a collection of reference and example network plugins for configuring connectivity in Linux and Windows containers. CNI supplies a specification and libraries, plus a command-line tool for executing plugins and a Go library for application integration. Interface options include bridge, ipvlan, loopback, macvlan, point-to-point, VLAN, host-device, and dummy; Windows-specific plugins include win-bridge and win-overlay. IP address management choices cover DHCP, host-local allocation tracking, and static IPv4 or IPv6 allocation. Meta plugins handle interface tuning, port mapping, bandwidth limits, source-based routing, and firewall rules, and a sample plugin illustrates custom plugin development. CNI focuses on connecting containers and removing allocated resources when a container is deleted. The project is distributed under Apache License 2.0 and is a Cloud Native Computing Foundation project. It is free, with a plan listed at free. Linux and Windows are supported; the latest release page lists Linux archives for amd64, arm, and arm64.

Network Service Mesh connects workloads across clusters and clouds through a hybrid, multi-cloud IP service mesh. Each workload can connect independently to zero or more Network Services, regardless of where it runs. The project says it works with an existing CNI without requiring changes to Kubernetes or workloads. Services can provide connectivity, security, and observability at Layer 3 and above, carrying IP or Ethernet payloads.

Clients may be Kubernetes pods, virtual machines, or physical servers. They authenticate independently, currently using SPIFFE IDs, and need authorization to attach. Clients request and close virtual wires over gRPC and can monitor connection status through a streaming call. Endpoint selection offers composition, selective composition, topology awareness, and scale from zero. A service may also provide domain-scoped DNS for connected pods. The architecture describes integration with Istio, Linkerd, Consul, and Kuma. Network Service Mesh is a CNCF sandbox project and is free and open source. Its run guide lists Docker, Go, a Kubernetes cluster, and kubectl as prerequisites; most examples require at least two worker nodes.