Open-source alternatives to Cilium

Kubescape is a security platform for Kubernetes that provides tools for scanning clusters, configurations, and container images against industry compliance and security benchmarks. It functions as a suite of security utilities, including a compliance auditor, a misconfiguration scanner, and a container vulnerability scanner. The project differentiates itself through automated remediation and active enforcement. It can automatically patch operating system vulnerabilities in images and fix security errors within manifest files. It also utilizes an admission controller to block the deployment of

Istio is a service mesh infrastructure that provides a centralized control plane to manage, secure, and observe communication between distributed microservices. It functions as a policy-driven network traffic controller, enabling developers to route, balance, and secure service-to-service traffic without requiring modifications to application code. The system enforces zero-trust security by utilizing mutual transport layer authentication to verify cryptographic identities for every network request. The project distinguishes itself through a sidecar-less proxy architecture, which offloads netw

This project is a high-performance, distributed API gateway designed to manage, secure, and observe traffic for microservices, serverless functions, and artificial intelligence model providers. It functions as a dynamic service proxy and cloud-native ingress controller, centralizing policy enforcement and traffic routing through a unified configuration interface that synchronizes state across multiple nodes in real time. The platform distinguishes itself through a highly extensible architecture that utilizes a high-performance scripting engine to execute modular logic directly within the requ

Ziti is a zero-trust network overlay and identity-based mesh network. It provides a software-defined perimeter that replaces traditional IP-based routing and VPNs by mapping network services to cryptographically verified identities, effectively cloaking applications from the public internet. The project distinguishes itself through an outbound-only connection model that eliminates open listening ports and a Zero Trust SDK that allows developers to embed encryption and identity-based access control directly into application source code. It also provides transparent tunneling proxies to extend

Talos is a minimal, immutable Linux distribution designed specifically for deploying and managing Kubernetes clusters. It functions as an API-driven infrastructure manager that replaces traditional shell access with a declarative gRPC interface to control operating system state and configuration. The system is distinguished by its use of a read-only root filesystem and a security-hardened kernel, which removes standard GNU utilities to reduce the attack surface. It ensures environment consistency by distributing the operating system as versioned, signed images and utilizes TPM-backed verified

Hazelcast is a distributed data platform that combines an in-memory data grid with a stream processing engine to support real-time analytics and event-driven applications. It functions as a partitioned, distributed key-value store that replicates data across cluster nodes to provide low-latency access and high availability. The platform also serves as a distributed SQL query engine, allowing users to execute standard SQL statements against both in-memory datasets and external data sources. What distinguishes Hazelcast is its use of a distributed consensus subsystem to maintain strongly consis

cert-manager is a Kubernetes TLS certificate manager and cluster add-on that automates the issuance and renewal of TLS certificates. It functions as a certificate lifecycle automator, managing certificates as native Kubernetes resources to secure internal and external network traffic. The project includes an ACME protocol client to automate certificate requests and validations from providers. It utilizes a controller to synchronize the desired state of certificates with responses from various certificate authorities. The system covers certificate provisioning from external issuers and vault

Fancyss is a network utility designed to function as a Shadowsocks proxy gateway. It operates as a transparent proxy manager that intercepts and routes network traffic at the gateway level, allowing for centralized management of internet access across all connected devices without requiring individual client-side configurations. The system employs policy-based routing and rule-based traffic filtering to direct data through specific network paths. It maintains multiple server connections simultaneously, utilizing failover-aware connection pooling to automatically switch traffic to healthy node

Pingora is a Rust-based framework for building high-performance network services, including HTTP reverse proxies, layer seven load balancers, and TLS termination proxies. It serves as an asynchronous network library designed to intercept and route HTTP, gRPC, and WebSocket traffic between clients and upstream backend servers. The project enables zero-downtime service updates by handing over listening sockets between processes during binary or configuration upgrades. It utilizes a programmable multi-phase pipeline to modify request and response bodies and headers, and it provides a pluggable T

The AWS Cloud Development Kit is an infrastructure-as-code framework that enables developers to define and provision cloud resources using familiar programming languages. By utilizing construct-based synthesis, it translates high-level, object-oriented code into declarative templates, allowing for the automated management of complex cloud environments through a centralized, code-driven control plane. The framework distinguishes itself through its ability to model infrastructure as a dependency-aware resource graph, ensuring that components are provisioned and updated in the correct order. It

Kuma is a multi-zone service mesh that orchestrates layer 4 and layer 7 network traffic between containers and virtual machines. It utilizes a centralized control plane to manage an Envoy-based data plane, providing a unified network overlay across multiple clouds, clusters, and on-premises environments. The project implements zero-trust network security through identity-based access control and mutual TLS encryption, automatically provisioning certificates to verify service identities. It supports multi-mesh management, allowing a single control plane to coordinate several independent or iso

Linkerd is a Kubernetes service mesh that manages network traffic between microservices. It functions as a transparent networking proxy, layer 7 traffic manager, and mutual TLS security layer, providing observability and reliability for service-to-service communication without requiring changes to application code. The project distinguishes itself through a sidecar-proxy architecture that intercepts TCP and application-level traffic to provide automatic mutual TLS encryption and identity verification. It enables cross-cluster service networking to link multiple clusters and implements cloud-n

Keepalived is a high availability manager and virtual IP failover tool that ensures continuous service availability. It coordinates the migration of floating IP addresses between master and backup nodes using the Virtual Router Redundancy Protocol to manage router redundancy and seamless failover. The project distinguishes itself by integrating with the Linux kernel IPVS module to function as a transport-layer load balancer. It distributes network traffic across backend servers using various scheduling algorithms and forwarding methods such as NAT, direct routing, or tunneling. The system in

This project is an open-source software development kit and framework for implementing the Matter smart home standard. It provides a universal IPv6-based application layer and a cluster-based data model to ensure interoperability between diverse smart home devices and controllers. The system is distinguished by its multi-transport network abstraction, which maps Bluetooth LE, Thread, and Wi-Fi implementations to a common layer. It includes specialized tooling for secure device commissioning via QR codes and NFC, as well as a comprehensive over-the-air firmware update system for distributing s

Kong is a high-performance API gateway and service connectivity platform designed to manage, secure, and monitor traffic across distributed microservices and hybrid cloud environments. It functions as a centralized control plane for service governance, providing essential traffic routing, load balancing, and request transformation capabilities to ensure consistent policy enforcement across all service endpoints. The platform distinguishes itself through a modular plugin architecture and a declarative configuration engine that allows infrastructure behavior to be defined via version-controlled

Consul is a distributed coordination service and service mesh tool used for service discovery, health monitoring, and cluster state management across dynamic networks. It provides a platform for locating network addresses of services and managing traffic across distributed infrastructure using DNS and HTTP interfaces. The project distinguishes itself through multi-datacenter network orchestration, enabling the federation of services across different regions using mesh gateways. It secures communication via a service mesh architecture that employs identity-based authorization and mutual TLS en

This project is a comprehensive infrastructure guide and technical reference for designing and deploying cloud native and AI native environments using Kubernetes. It serves as a manual for managing container orchestration, pod lifecycles, and declarative state reconciliation to maintain scalable cluster workloads. The resource provides instructional material on building custom controllers and implementing operational logic via the operator pattern. It also functions as a framework for optimizing the delivery of large language models through specialized gateways and workload scheduling. The h

Kubeasz is an automation framework designed for the lifecycle management of production-grade Kubernetes clusters. It functions as an Ansible-based provisioner that orchestrates the installation, scaling, and maintenance of cluster components across distributed Linux nodes. By utilizing inventory-driven management and role-based task modularization, the project ensures that infrastructure configurations remain consistent and reproducible across diverse environments. The platform distinguishes itself through its focus on automated system administration and operational continuity. It provides bu

HAProxy is a high-performance TCP and HTTP proxy that distributes traffic across multiple backend servers to ensure availability and fault tolerance for critical services. It operates in either TCP or HTTP mode, with an event-driven, single-threaded reactor that handles tens of thousands of connections without context switching, and supports kernel-level data transfer to minimize memory usage and latency. What distinguishes HAProxy is its configuration-file-first design, where all load-balancing rules and runtime behavior are defined in a declarative text file parsed at startup. It embeds a L

Vault is a centralized secrets management platform designed to secure, store, and control access to sensitive credentials such as API keys, passwords, certificates, and encryption keys. At its core, the system employs a barrier-based cryptographic sealing mechanism that requires an unseal process to decrypt internal storage, ensuring that sensitive data remains protected. It provides identity-based access control to manage granular permissions across distributed infrastructure, effectively centralizing security policies and authentication for both human and machine workloads. What distinguish

OpenSpeedy is a network acceleration utility designed to optimize data transmission between applications and remote servers. It functions as a congestion control middleware and traffic processing engine, operating within the kernel space to minimize latency and reduce CPU overhead during packet delivery. The project distinguishes itself through its ability to aggregate multiple network interfaces into a single logical stream, enhancing bandwidth and link reliability. It employs custom transport protocols that bypass head-of-line blocking and utilizes forward error correction to reconstruct lo

MetalLB is a Kubernetes load balancer implementation and IP address manager designed for bare metal clusters. It functions as a networking tool that provides external connectivity and traffic distribution by assigning external IPv4 and IPv6 addresses to services. The project differentiates itself by providing two distinct advertisement modes. It can operate as a BGP routing controller, using the Border Gateway Protocol to announce service IPs to external routers with support for bidirectional forwarding detection and VRF-aware routing. Alternatively, it can act as a Layer 2 network advertiser

Kyverno is a Kubernetes policy engine and cloud native governance tool. It functions as a policy-as-code framework that validates, mutates, and generates resources to enforce security and governance standards within a cluster. The project distinguishes itself through a declarative policy model that utilizes native Kubernetes custom resource definitions, allowing policies to be managed as standard cluster objects without custom code. It provides specific security capabilities for container image verification and signature validation to ensure only trusted images are deployed. Its broader capa

gost is a multi-protocol proxy tunnel and secure tunneling server designed to route network traffic through encrypted connections. It functions as a traffic obfuscation gateway and a transparent proxy server capable of intercepting TCP and UDP traffic at the IP level. The project also includes a virtual network interface manager for creating TUN and TAP devices to intercept operating system packets. The system distinguishes itself through a chain-based request routing model, allowing traffic to pass through an ordered sequence of proxy nodes. It provides extensive transport-layer encapsulatio

Opensnitch is a host-based application firewall for Linux that monitors and intercepts outbound network connections in real time. By hooking into kernel-level interfaces, it tracks system-wide network activity and maps connection attempts to specific local processes, allowing users to explicitly permit or deny traffic on a per-application basis. The project distinguishes itself through its ability to manage security policies across multiple distributed nodes from a single, unified dashboard. This centralized management is secured via encrypted socket communication, enabling consistent rule en

Submariner is a tool for connecting pods and services across separate Kubernetes clusters into a unified network mesh. It uses a central broker-based architecture to coordinate cross-cluster service discovery, DNS resolution, and encrypted tunneling, enabling secure communication between workloads in different clusters. The project handles overlapping pod and service CIDR ranges across clusters through global IP address mapping, preventing address collisions. It supports multiple encrypted tunnel protocols, including IPsec and WireGuard, to secure inter-cluster traffic, and provides gateway h

Netdata is a distributed observability platform designed for real-time infrastructure monitoring and performance tracking. It functions as a high-frequency agent that collects system, container, and application metrics with per-second precision, providing both local visualization and centralized aggregation across complex, multi-cloud environments. The platform distinguishes itself through edge-based intelligence, utilizing local machine learning models to automatically detect performance anomalies without requiring manual configuration or external query engines. Its architecture prioritizes