Flannel vs Network Service Mesh

Flannel is a free network fabric for containers designed for Kubernetes. A small flanneld agent on each host allocates a subnet lease from a configured address space, then forwards packets between hosts using a selected backend. Documented choices include VXLAN, host-gw, WireGuard and UDP, with VXLAN recommended. WireGuard encapsulates and encrypts packets using the in-kernel WireGuard implementation. Network configuration and subnet allocations can be stored in the Kubernetes API or directly in etcd. The project documents Kubernetes and Docker deployments, with Linux and Windows build instructions. Flannel does not enforce network policies itself, though its Helm chart can deploy a Kubernetes SIGs network policy controller alongside it. It runs as a privileged daemonset with access to the host network, so the security policy advises least privilege and keeping it updated. Security fixes are maintained for the latest release only, and the backend documentation says not to change a selected backend at runtime.

Network Service Mesh connects workloads across clusters and clouds through a hybrid, multi-cloud IP service mesh. Each workload can connect independently to zero or more Network Services, regardless of where it runs. The project says it works with an existing CNI without requiring changes to Kubernetes or workloads. Services can provide connectivity, security, and observability at Layer 3 and above, carrying IP or Ethernet payloads.

Clients may be Kubernetes pods, virtual machines, or physical servers. They authenticate independently, currently using SPIFFE IDs, and need authorization to attach. Clients request and close virtual wires over gRPC and can monitor connection status through a streaming call. Endpoint selection offers composition, selective composition, topology awareness, and scale from zero. A service may also provide domain-scoped DNS for connected pods. The architecture describes integration with Istio, Linkerd, Consul, and Kuma. Network Service Mesh is a CNCF sandbox project and is free and open source. Its run guide lists Docker, Go, a Kubernetes cluster, and kubectl as prerequisites; most examples require at least two worker nodes.