Istio

Cilium is an open-source networking, observability, and security solution for Kubernetes, with an eBPF-based dataplane. As a Container Network Interface (CNI) plugin, it provides overlay or native-routed networking, distributed load balancing, cluster-to-cluster connectivity through Cluster Mesh, and identity-based network policies covering L3 through L7. Its eBPF programs can attach at Linux network I/O, application sockets, and tracepoints; this supports features including kube-proxy replacement, socket-level service load balancing, XDP-based north-south load balancing, DNS- and protocol-aware policy enforcement, and service-mesh functions using IPSec or WireGuard. Cilium also includes Hubble for flow visibility, service maps, and DNS- and protocol-aware observability, with integrations for monitoring systems such as Prometheus and Grafana. The user-space components are licensed under Apache License 2.0, while the BPF code templates are dual-licensed under GPL-2.0-only and the 2-Clause BSD License.

Higress is a cloud-native API gateway and AI gateway developed as a vendor-neutral CNCF project. Based on Istio and Envoy, it supports Kubernetes Ingress and Gateway APIs, microservice discovery, security controls, unified LLM API management, and hosting MCP (Model Context Protocol) servers through plugins. The gateway is extended with WebAssembly plugins written in Go, Rust, or JavaScript. Its plugin mechanism supports streaming request and response processing, authentication and authorization, rate limiting, audit logging, observability, WAF features, AI model routing, token rate limiting, caching, and conversion of OpenAPI specifications into remote MCP servers. Higress provides an out-of-the-box console and can run with Docker or be deployed on Kubernetes using Helm.

Envoy is a cloud-native, high-performance edge, middle, and service proxy hosted by the Cloud Native Computing Foundation (CNCF). In the cited AI-agent security setup, it validates inbound tokens before requests reach agent code.

Sockudo is a self-hosted, high-performance Rust real-time server for WebSocket and HTTP publishing. It targets strict Pusher Protocol V1 compatibility for drop-in use, while Protocol V2 adds Sockudo-native events, serials, message IDs, recovery, rewind, tags, deltas, annotations, and mutable message events. The platform supports durable history, hot replay buffers, two-tier recovery, presence history, push notifications, webhooks, rate limiting, TLS, Prometheus metrics, Docker Compose, and Helm. Horizontal fanout can use Redis, Redis Cluster, NATS, RabbitMQ, Google Pub/Sub, Kafka, Pulsar, or Apache Iggy. The monorepo includes the Rust server and workspace crates, dashboards, deployment assets, documentation, official real-time and server SDKs, and an optional AI Transport SDK.

NetBird is an open-source, WireGuard-based overlay networking and Zero Trust Network Access platform for connecting remote users, cloud and on-premises resources, edge devices, containers, and agents through peer-to-peer encrypted tunnels. Its agents manage WireGuard connections, obtain peer candidates through ICE and STUN, exchange connection information through a signaling service, and use a relay when direct connections fail. A centralized management service maintains network state, peer addresses, access policies, and configuration updates, while the admin interface supports identity-based access control, network segmentation, SSO, MFA, device posture checks, private DNS, routes, exit nodes, SSH, reverse proxying, activity logging, and integrations such as Terraform and Ansible. NetBird can run as a hosted cloud service or be self-hosted; its repository includes the client, management, signal, and relay components, with most code licensed under BSD-3-Clause and the management, signal, and relay directories under AGPLv3.