MeshAtom
Sidecar-Less eBPF-Native Namespace-Scoped

Enterprise-Grade Security. Zero Cluster Bloat.

Meet MeshAtom: The world's first purely eBPF-powered, namespace-isolated service mesh. No Envoy, no cluster-admin risks, and no heavy CRDs. Just blazing-fast, kernel-level mTLS.

One namespace-bound DaemonSet. Any cluster. Under a minute.

Works the same on EKS, AKS, GKE, OpenShift, Rancher, and on-prem — no CNI swap, no cluster-wide install.

Why does securing Kubernetes have to break your cluster?

Traditional service meshes force you into a corner. They demand critical Cluster-Admin privileges, flood your API server with hundreds of complex CRDs, and risk crashing your entire infrastructure during control plane upgrades. Even other eBPF alternatives force you to completely rip out and replace your underlying network CNI. Add the massive CPU/Memory tax of Envoy proxies, and you are paying a premium for complexity.

Meet MeshAtom: The Next Generation of Service Mesh

Built from completely new, custom code operating natively at the kernel level.

We stripped away the sidecars, eliminated the cluster-wide blast radius, and built a service mesh that deploys strictly at the namespace level. Drop a single namespace-bound DaemonSet onto any cloud or on-prem Kubernetes cluster — no CNI replacement, no cluster-admin, no multi-hour rollout. Your developers get maximum security; your platform team gets absolute peace of mind.

Key Capabilities

Zero-Trust Security, Isolated Blast Radius

  • Common Criteria Encryption, Minimal Overhead: Meet AICPA Trust Services Criteria for encryption in transit (CC6.x logical access, CC7.x system operations) — auditors require data moving across networks to be protected from interception and tampering. MeshAtom delivers that with kernel-level mTLS and ultra-low CPU/memory cost.
  • Deploy Anywhere in Minutes: One namespace-bound DaemonSet on any cloud or on-prem cluster. Same simple install whether you run EKS, AKS, GKE, OpenShift, Rancher, or bare metal.
  • Namespace-Only Deployment: Deploy, manage, and upgrade strictly within a single namespace. An upgrade failure in Dev will never take down Production.
  • No Cluster-Admin Needed: Keep your cluster secure. Your team can deploy MeshAtom without needing god-mode cluster privileges, we need only node level access to eBPF.
  • Pure eBPF mTLS: High-performance, bidirectional certificate-based encryption and authorization operating directly in the Linux kernel.

Uncompromising Performance & Flexibility

  • No Envoy Overhead: Custom-coded from the ground up to achieve native kernel speeds with ultra-low CPU and memory footprints.
  • 4 Dynamic Network Modes:
    1. CNI Replacement — run completely standalone
    2. CNI Overlay — layer on top of any existing CNI
    3. Smart Passthrough — zero encryption for same-node traffic
    4. Strict Encryption — full pod-to-pod kernel-level encryption

Built-in Cost Optimization

Smart Scale-to-Zero: Slash your cloud bill in non-production environments. Let idle Dev/QA workloads sleep. The lightweight MeshAtom node agent stays awake, catches incoming requests, and instantly wakes up the exact pod needed on-demand.

Native eBPF Observability

Out-of-the-box network visibility built straight into the kernel. Need deeper analytics? MeshAtom seamlessly integrates with your existing eBPF monitoring tools like Groundcover.

Simple Deploy. Any Cloud. Any On-Prem Cluster.

No cluster-wide impact. No CNI lock-in. No cloud lock-in. No special install path per platform. Apply one namespace-bound DaemonSet and get identical kernel-level security across hybrid, multi-cloud, and on-prem environments.

Engineering Blog

Deep dives for Platform Architects — annotations, scale-to-zero, and namespace PKI.

Network Mode Annotations

YAML snippets to toggle CNI Replacement, Overlay, Passthrough, and Strict mTLS via namespace annotations.

Smart Scale-to-Zero

How the agent buffers TCP SYNs in eBPF while waking dormant pods — no client retries.

Namespace Certificate Rotation

Rotate mTLS identities per namespace without a cluster-wide CA or cluster-admin.

Ready to drop the sidecar weight?

Deploy a single namespace-bound DaemonSet agent on any cloud or on-prem Kubernetes cluster and secure your first namespace with MeshAtom in under a minute.