Why Sidecar Meshes Create Performance Problems at Scale

▶ Watch (0:18)

Traditional sidecar meshes couple proxies tightly to each application pod. At scale that coupling produces measurable resource overhead and added latency from extra network hops. KMesh was built to solve this. It uses eBPF to handle traffic management inside the kernel, removing the sidecar entirely. Two modes exist: kernel-native for maximum performance, and a dual-engine mode that offloads L4 to the kernel and keeps L7 processing in user space for environments that need more flexibility.

Why Envoy Became a Liability for KMesh

▶ Watch (1:17)

KMesh’s dual-engine mode still requires L7 processing, handled by a waypoint proxy. Until now that proxy was Envoy. Envoy works, but it presents three specific problems for KMesh. First, it is written in C++, which carries memory safety risk. Second, years of accumulated features make it heavy and complex. Third, its architecture was not designed to integrate with eBPF. Those constraints motivated Huawei to write a replacement from scratch rather than patch around Envoy’s design.

Orion: A Rust Proxy Built Only for What KMesh Needs

▶ Watch (2:12)

Orion is Huawei’s answer. It implements the proxy in Rust using open-source components, and intentionally skips most of Envoy’s API surface. The team chose not to replicate every Envoy filter or API. Only the subset KMesh actually uses is present. That constraint keeps the binary lightweight and the codebase straightforward to maintain. The design goal was a proxy that fits the KMesh eBPF architecture specifically, not a general-purpose proxy that happens to run there.

Benchmark Results: 2x to 4x Over Envoy

▶ Watch (3:04)

Huawei ran direct benchmarks between Orion and Envoy. Orion delivers 2x to 4x higher throughput and dramatically lower latency. Those gains come from the simpler design. Fewer filters and a smaller API surface mean less code in the hot path. Rust’s memory model removes the overhead of C++ safety workarounds. The benchmarks confirm that removing complexity produces measurable performance gains, not just cleaner code.

Current Status and the Complete KMesh Picture

▶ Watch (3:30)

The end-to-end path is already working. Orion runs inside a real KMesh cluster alongside performance tests and integrates natively with KMesh’s eBPF layer. The next phase is performance tuning and hardening for production. Once complete, KMesh handles L4 at kernel speed via eBPF and Orion handles L7 in user space. Every layer of the data path operates without C++ or its associated safety risks anywhere in the stack.

Notable Quotes

Orion delivers 2x to 4x high performance, highest throughput along with dramatical early lower latency. Zengzeng Yao · ▶ 3:15

we made a conscious choice not to implement every single envoy API and filter Zengzeng Yao · ▶ 2:22

A service mesh where every layer operates at yes theoretical performance sailing with no C++ C++ safety baggage anywhere in the data pass. Zengzeng Yao · ▶ 4:33

Key Takeaways

  • KMesh’s dual-engine mode offloads L4 to the kernel and keeps L7 in user space.
  • Orion, written in Rust, delivers 2x to 4x higher throughput than Envoy in benchmarks.
  • Orion already runs in a real KMesh cluster; production hardening is the next step.