Zero-Trust Service Mesh Security for Kubernetes

Founded in 2015 by former Twitter infrastructure engineers William Morgan and Oliver Gould, Buoyant is the company behind Linkerd, the open source service mesh that helped define the category and has since graduated from the CNCF. Its buyers are platform and infrastructure teams running Kubernetes at scale, alongside regulated enterprises that need encrypted, policy-controlled service-to-service communication without rewriting application code. The site cites production users including Xbox, Walmart, Expedia, Comcast, GoDaddy and Hewlett Packard.

The mesh works by injecting a lightweight proxy, written in memory-safe Rust, alongside every application pod. That proxy transparently wraps each TCP connection in mutual TLS using short-lived certificates bound to the pod's Kubernetes ServiceAccount and rotated roughly every 24 hours, so identity is cryptographic rather than IP-based, with private keys held in memory. Authorization is expressed as Kubernetes custom resources and enforced locally inside each proxy, producing a deny-by-default posture that constrains lateral movement between workloads.

Positioning rests on operational simplicity relative to Istio and Cilium: no code changes, a proxy footprint under 10MB, and fully automated certificate handling. The commercial distribution layers on FIPS 140-2 and 140-3 validated encryption for FedRAMP-style requirements, an audit mode that logs policy violations before enforcement, policy generation from observed traffic, multi-cluster failover, and HAZL zone-aware load balancing aimed at cross-zone networking spend. Training and certification run through the vendor's Service Mesh Academy.