Service Mesh Comparison: Istio vs Linkerd vs Cilium

Choose the right service mesh for your Kubernetes cluster. Compare Istio's full-featured approach, Linkerd's simplicity, and Cilium's eBPF-based performance — with real overhead benchmarks and mTLS examples.

Feature Comparison

Linkerd — Install and Enable mTLS

# Install Linkerd CLI
curl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/install | sh

# Validate cluster compatibility
linkerd check --pre

# Install Linkerd control plane
linkerd install --crds | kubectl apply -f -
linkerd install | kubectl apply -f -

# Verify installation
linkerd check

# Enable mTLS for a namespace (inject sidecar proxy)
kubectl annotate namespace production \
  linkerd.io/inject=enabled

# Roll deployments to pick up the sidecar
kubectl rollout restart deployment -n production

# Verify mTLS is active
linkerd viz install | kubectl apply -f -
linkerd viz edges deployment -n production

# Output shows: src → dst, secured=true for mTLS connections

Istio — mTLS Strict Mode

# Install Istio with minimal profile
istioctl install --set profile=minimal -y

# Enable sidecar injection for a namespace
kubectl label namespace production istio-injection=enabled

# Enforce strict mTLS for the entire mesh
kubectl apply -f - <<EOF
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: istio-system
spec:
  mtls:
    mode: STRICT
EOF

# Namespace-scoped strict mTLS
kubectl apply -f - <<EOF
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: production
spec:
  mtls:
    mode: STRICT
EOF

# Verify mTLS with Kiali or:
istioctl x authz check <pod-name>.production

Cilium — eBPF Install + WireGuard Encryption

# Install Cilium (replaces kube-proxy)
helm repo add cilium https://helm.cilium.io/
helm install cilium cilium/cilium \
  --namespace kube-system \
  --set kubeProxyReplacement=true \
  --set k8sServiceHost=<API_SERVER_IP> \
  --set k8sServicePort=6443 \
  --set encryption.enabled=true \
  --set encryption.type=wireguard

# Verify Cilium status
cilium status
cilium connectivity test

# Enable Hubble observability
helm upgrade cilium cilium/cilium \
  --namespace kube-system \
  --set hubble.relay.enabled=true \
  --set hubble.ui.enabled=true

# View service flows
hubble observe --namespace production --follow

# Check encryption status
cilium encrypt status

When to Choose Each Mesh

• Istio: Complex traffic management (canary, blue-green, fault injection), full distributed tracing, authorization policies at L7, enterprise compliance requirements, multi-cluster deployments.
• Linkerd: Team wants zero-config mTLS with minimal overhead, simplicity is valued, small to medium clusters, Rust proxy reliability, no complex traffic routing needs.
• Cilium: Performance-critical workloads, replacing kube-proxy for kernel-level efficiency, high-throughput data plane, CNI replacement needs, large-scale clusters where sidecar memory adds up.