Linkerd

Linkerd adds security, observability and reliability to a Kubernetes cluster while deliberately avoiding the complexity of larger meshes. It is fully open source, CNCF graduated, and written in Rust, and the project publishes benchmarks showing it running faster than Istio while consuming a fraction of the system resources. Recent releases have added rate-limit-aware load balancing and reduced memory use.

Choosing Rust for the proxy is a security argument rather than a fashionable one. Memory-unsafe proxies have produced a long record of buffer overflow vulnerabilities, and writing the data plane in a language that prevents that class of bug removes an entire category of CVE from software that sits in the path of every request.

Restraint is the product strategy. The project's positioning is explicitly about what it does not do, which suits a team that wants mutual TLS, retries and golden metrics rather than a programmable network, and which makes the operational learning curve materially shorter.

Customer accounts in the project's own material point at the same two savings: engineering hours not spent maintaining an in-house mutual TLS implementation, and cost reduction from fewer failed requests. Both are worth measuring against a team's own numbers rather than accepted as given.