AI
Why Infrastructure Fractures Under Business Growth
Companies grow, acquire other companies, and absorb their IT systems. Each event adds heterogeneous infrastructure that must still communicate. Compliance requirements compound the problem: entering a new market can trigger a mandate to enable a web application firewall across the entire estate. Assmann’s framing is direct. The wish is a simple, straightforward system. The reality is a fractured one, where a new application may need to call a web service exposed by a system built a decade earlier.
Why Routers and Service Mesh Both Fall Short
Traditional networking tools, routers, VPNs, and WAFs, have existed for decades but carry no application-layer context. They cannot tell you what traffic means, only where it goes. Service mesh fixed that visibility problem but introduced a scope constraint. It works inside Kubernetes. It can sometimes span a couple of clusters. A PHP application running on a VM sits outside the boundary. Assmann’s conclusion: service mesh was a good start, but the industry needs something that covers the full fractured estate.
The Universal Mesh Pattern: Federation Across Everything
Universal Mesh is the architecture pattern HAProxy proposes to replace the patchwork. The core requirement is federation. Without the ability to federate systems running on multiple clouds and multiple data centers, the pattern cannot work. The mechanism uses approved protocols: mTLS for encryption and ACLs to define which services may speak to which. Those controls apply on any cloud provider and in any data center, so the same policy model covers every node in the estate regardless of where it runs.
Supporting Legacy, Current, and AI Workloads on One Plane
Assmann positioned Universal Mesh explicitly to cover three generations of workload at once: current production systems, legacy applications, and what he called AI factory projects. He told the audience that if they do not have an AI factory project today, they will have one soon. Because Universal Mesh relies on widely distributed, well-established protocols, scaling to accommodate that new class of workload does not require replacing existing proxies. Existing components stay in place and join the federated mesh rather than being ripped out.
Notable Quotes
service mesh was a good start, but we need as an industry to come with something more universal. That’s why we call this architecture pattern the universal mesh. Baptiste Assmann · ▶ 3:25
if you don’t have one yet, you will have one for sure at some point in time very soon Baptiste Assmann · ▶ 4:41
Key Takeaways
- Service mesh works only inside Kubernetes, leaving VM-based workloads unprotected and unobserved.
- Universal Mesh uses mTLS and ACLs to federate proxies across clouds and data centers.
- The same pattern is designed to absorb AI factory workloads without replacing existing infrastructure components.
About the Speaker(s)
Baptiste Assmann is Director of Product at HAProxy Technologies. He built his career on networking and high-performance architecture. At HAProxy, he leads product strategy spanning bare metal deployments, Kubernetes, load balancing, and advanced security at scale.