DE-flag
Back Back to English site
Get started
Aviatrix Blog

A Service Mesh Provides Great Kubernetes Network Security, Unless . . .

Explore the limitations of service mesh security for Kubernetes and how the Aviatrix Kubernetes Firewall provides a better solution.

Robert Panzer srcset=
April 1, 2025 in Kubernetes, KubeCon By Robert Panzer

What is a service mesh?

A service mesh provides a dedicated layer to observe, manage, and control communications across microservices. Among other benefits, a service mesh offers a variety of security features for your Kubernetes environment. Example capabilities include mutual TLS (mTLS) encryption, identity-based access control, security policy enforcement, Zero Trust security model, certificate management, auditing and logging, and more.

 

How does it work?

Service meshes require a sidecar container to cohabitate with the pods. The sole purpose of this sidecar is to create tunnels to other sidecars/envoys within the mesh. This provides high levels of control for encryption, observability, and application-layer security. Kubernetes service meshes are complex to manage and can require specialized knowledge, but the power they offer can more than make up for that added complexity.

 

So, what’s the problem?

All of the capabilities of the service mesh are available only within the mesh. Any resources outside the mesh will not be able to leverage those benefits. If you have only Kubernetes-to-Kubernetes communication and you can manage the complexity of a mesh, there is no problem. But if you have Kubernetes-to-non-Kubernetes workloads—which is extremely common—then you have all the complexity of a service mesh, and on top of that you still have to solve for challenges such as egress security, identity-based segmentation, and multicloud and hybrid workload connectivity.

 

Aviatrix delivers network security for the cluster and beyond

The Aviatrix Kubernetes Firewall extends our Distributed Cloud Firewall to Kubernetes, delivering comprehensive security and networking capabilities. It offers a cloud-native, scalable, and centralized approach to Kubernetes security by addressing gaps left by container network interfaces (CNIs) and service meshes. Here are just a few of the ways that Aviatrix Kubernetes Firewall enables you to extend security beyond the cluster and unify management and control in a hybrid and multicloud environment:

  • Extend security to outbound (egress) traffic: Aviatrix enables you to enforce policy-based egress filtering, ensuring that only authorized applications can communicate externally. This helps prevent data exfiltration and maintain compliance with PCI-DSS, HIPAA, SOC 2, etc.
  • Extend security to non-Kubernetes workloads: Aviatrix provides seamless Kubernetes-to-virtual machine (VM) integration with security across containerized workloads and legacy applications. You can encrypt traffic between on-premises and cloud-based clusters and enforce policies across hybrid Kubernetes workloads. This enables consistent policy application and communication between VMs and Kubernetes clusters.
  • Unify policy management and orchestration: Aviatrix provides a centralized control plane that allows you to define, manage, and enforce policies across multiple clusters and clouds. Automated orchestration reduces complexity and improves your overall security posture.
  • Unify hybrid and multicloud visibility: Aviatrix delivers full visibility into outbound traffic across clusters. You get network-layer visibility details down to the packet—no expensive and complex traffic mirror services needed.

 

If you’re running Kubernetes workloads beyond the service mesh, you’re adding complexity to the management of network security across the entire environment. Schedule a demo to explore how the Aviatrix Kubernetes Firewall extends and unifies network security beyond the Kubernetes environment.

 

Additional Kubernetes network security resources