Comparison of Service Mesh: Istio vs Linkerd vs Cilium?

Question

Accepted Answer

**Comparison of three Service Meshes:**

| Criterion | Istio | Linkerd | Cilium |
|---------|-------|---------|--------|
| Proxy | Envoy (C++) | linkerd2-proxy (Rust) | eBPF (kernel) |
| Latency overhead | 3-5ms | <1ms | <0.5ms |
| RAM per Pod | ~60MB | ~10MB | ~5MB |
| mTLS | Manual setup | Auto | Auto |
| L7 traffic mgmt | Advanced | Basic | Moderate |
| Gateway API | Yes | Yes | Yes |
| eBPF | No | No | Yes |

**Istio (most feature-rich):**
```bash
istioctl install --set profile=default
kubectl label namespace prod istio-injection=enabled
```
Plus: VirtualService, DestinationRule, fault injection, A/B routing.

**Linkerd (simplest):**
```bash
linkerd install --crds | kubectl apply -f -
linkerd install | kubectl apply -f -
linkerd check
```
Plus: instant startup, simple installation, built-in dashboard.

**Cilium (fastest):**
```bash
helm repo add cilium https://helm.cilium.io/
helm install cilium cilium/cilium --namespace kube-system
```
Plus: eBPF networking (replaces kube-proxy + iptables), NetworkPolicy L7, Hubble (observability).

**Choice:**
- Maximum features → Istio.
- Simplicity and speed → Linkerd.
- Performance and security → Cilium.

DevOps: Comparison of Service Mesh: Istio vs Linkerd vs Cilium?