Meshlib：无 Sidecar 服务网格的进程内策略执行机制
Meshlib: In-Process Policy Enforcement for Sidecar-less Service Meshes
AI总结：
本文提出 Meshlib，一种基于 Cilium 的无 Sidecar 服务网格扩展，通过应用进程内策略执行与 Cilium eBPF 数据平面的职责分离，在保障安全的同时降低延迟，经 TrainTicket 基准测试表现最优。
AI中文摘要：
服务网格在微服务架构中实现服务间通信并强制执行安全策略，但通常依赖每个 Pod 的 Sidecar 代理，每次请求时的应用层冗余解析会带来显著延迟和资源开销。在不削弱安全保障的前提下消除 Sidecar 仍是核心挑战。为解决该问题，本文提出 Meshlib，它是基于 Cilium 控制面扩展构建的无 Sidecar 服务网格扩展。Meshlib 包含一个非侵入式的应用绑定库，可在应用进程内强制执行第 7 层（Layer-7）策略，同时将传输层身份与路由委托给 Cilium 基于 eBPF 的数据平面。这种职责分离消除了 Sidecar 导致的延迟，同时保留服务网格的安全语义，架构仍可与未修改的服务完全互操作，支持在现有部署中逐步采用。本文在 TrainTicket 基准测试中，对比 Istio、Linkerd 和未修改的 Cilium，对 37 个服务强制执行 126 项安全策略，结果显示 Meshlib 在所有评估配置中实现最低端到端延迟，且资源开销相当。
英文摘要：
Service meshes facilitate service-to-service communication and enforce security policies in microservice architectures. However, they often depend on per-pod sidecar proxies, which introduce significant latency and resource overhead due to redundant application-layer parsing on every request. Eliminating sidecars without compromising security guarantees remains a central challenge. To address this, we introduce Meshlib, a sidecar-less service mesh extension built on Cilium as a control-plane extension. Meshlib incorporates a non-intrusive application-bound library that enforces Layer-7 policies within the application process, while delegating transport-level identity and routing to Cilium's eBPF-based data plane. This separation of responsibilities removes sidecar-induced latency and maintains the security semantics of the service mesh. The architecture remains fully interoperable with unmodified services, enabling incremental adoption within existing deployments. We evaluate Meshlib against Istio, Linkerd, and unmodified Cilium on the TrainTicket benchmark, enforcing 126 security policies across 37 services and show that it achieves the lowest end-to-end latency of all evaluated configurations with comparable resource overhead.
