В Блоге Istio есть статья "Istio: The Highest-Performance Solution for Network Security" с очень любопытными замерами! Сравнивалась производительность при шифровании трафика для ряда решений:
- Istio: 1.26 (prerelease), default settings
- Linkerd: edge-25.2.2, default settings
- Cilium: version v1.16.6 с kubeProxyReplacement=true
WireGuard uses encryption.type=wireguard
IPsec uses encryption.type=ipsec with the GCM-128-AES algorithm
Additionally, both modes were tested with all of the recommendations in Cilium’s tuning guide (including netkit, native routing mode, BIGTCP (for WireGuard; IPsec is incompatible), BPF masquerade, and BBR bandwidth manager).
- Calico: version v3.29.2 с calicoNetwork.linuxDataplane=BPF и wireguardEnabled=true
- Kindnet: version v1.8.5 с --ipsec-overlay=true.