Flomesh Service Mesh (FSM) is a free, open-source service mesh for managing traffic and governing microservices on Kubernetes. It runs self-hosted and uses the Flomesh Pipy proxy, automatically adding it as a sidecar to onboarded applications. Traffic controls include shifting, ingress and egress, and Kubernetes Gateway API capabilities. FSM handles HTTP, TCP, gRPC, and MQTT traffic, and supports mutual TLS and fine-grained service access policies. Certificate management can use Tresor, cert-manager, or HashiCorp Vault. Prometheus and Grafana integrations are listed as stable, while Jaeger distributed tracing is beta; integration guides also cover Dapr and discovery registries such as Consul, Eureka, and Nacos. FSM supports x86 and ARM architectures and multi-cluster connectivity through the MCS API, though multicluster is marked alpha. Installation requires Kubernetes 1.19 or later, and version 1.1 is listed for Kubernetes 1.19 through 1.24. Its Gateway API support has limits: ReferenceGrant is unsupported, and several resources are only partially supported.
Who it is for
FSM suits teams operating Kubernetes microservices that need traffic controls, service-to-service security, and certificate management. It is also relevant to teams working across multiple clusters, though that capability is marked alpha.
What is good
- Free and open source, with self-hosted deployment.
- Supports HTTP, TCP, gRPC, and MQTT traffic.
- Provides mutual TLS and fine-grained access policies.
- Supports x86 and ARM architectures.
What to know first
- Requires Kubernetes 1.19 or later.
- Multicluster support is marked alpha.
- ReferenceGrant is unsupported; some Gateway API resources are partial.
- The init container runs as root and adds NET_ADMIN.
Verdict
FSM combines traffic management, service security, and several certificate and observability integrations for Kubernetes. Check the Kubernetes version range and Gateway API limitations against your environment before adopting it.
Flomesh Service Mesh plans and pricing
All plansCompared on service mesh platforms
- Deployment model
- self_hosted
- Proxy architecture
- sidecar
- mTLS support
- Yes
- Traffic policies
- Yes
- Multi-cluster support
- Yes
- Supported platforms
- Kubernetes, OpenShift
