How is Greymatter Different from Istio?
Today’s enterprise businesses need to govern enterprise architectures and accelerate software delivery for increased speed to market. Likewise, they must achieve all of this while enabling zero-trust security across apps, APIs, and microservices across multiple environments.
Initially, they may turn to an open-source service mesh solution, such as Istio, to provide service networking for managing internal service-to-service communications. A service mesh uses a centralized, configurable control plane that connects individual microservices using a data plane. This data plane is typically composed of Envoy proxies which are used in multiple topologies to include sidecars, or in the case of Ambient Mesh, waypoints. In essence, a service mesh aspires to enable developers and operations teams to secure, connect, and monitor services within Kubernetes. However, this often comes at the cost of low-level infrastructure integration and hefty configuration.
While migrating from development to enterprise production, many enterprises realize the need for additional application networking capabilities to make a “whole” product that is useful at scale.
Therefore, it’s important to understand the difference between an application networking platform, such as Greymatter, and an open-source service mesh, such as Istio.
Greymatter is more than a service mesh.
Our mission is to help organizations address the challenges of accelerating software development, while ensuring a repeatable delivery model and zero-trust security. Greymatter provides enterprise-grade service mesh capabilities including our own control plane and the use of data planes, built upon the Envoy proxy. Envoy is core to our “service networking” implementation. We do support using an Istio control plane with our application layer, but our packaged stand-alone control plane is light weight, scalable, speaks Cue and does not require Kubernetes to run. In addition, our platform combines service mesh with application and API endpoint management, sense-making intelligence, military-grade zero-trust policy control, and a development to production delivery channel into a single, unified platform. We deliver unprecedented control, security, and visibility across any on-premise, container, or multi-cloud environment.
A brief bit about Istio.
Many of our customers use large and small vendors with related Kubernetes technologies, but all of our customers have workloads running on more than just Kubernetes. Large vendors have “check box” offerings to connect an Istio service mesh to non-Kubernetes VMs. However they lack sophistication, are complex to setup and maintain, and most importantly fall short of solving real-world application networking needs.
Other vendors are Istio-specific, attempting to take a single-purpose open source project and make it more enterprise-ready. In the end, Istio is a control plane built natively for Kubernetes. It requires Kubernetes to run. Istio uses Envoy to act as its data plane, but often requires in-depth knowledge of Envoy itself to really get the most out of it. Together, Istio and Envoy combine to create an open source service mesh.
Often, you are paying for expertise to help establish this service mesh. Unfortunately, you will also pay to set up an entire series of other capabilities, need script magic to glue them together, and generate a mass hairball of configuration files to meet your enterprise business use cases. We do not believe this is ideal or a desired end-state for any enterprise-scale platform.
Greymatter is business-first traffic control.
To do traffic control across distributed enterprise services you have to ensure it works anywhere. Greymatter runs in non-Kubernetes environments, including bare metal, native cloud infrastructure, and on-premise data centers. This includes environments where disruptions, intermittent connectivity, and low bandwidth are the norm. In addition, we also have first-class Kubernetes support with full lifecycle management using an operator. This allows us to perform reliable, consistent multi-environment traffic management everywhere.
Our ability to connect to any public, private, hybrid or multi-cloud environment allows enterprises to bridge cloud networks to on-premise networks and Kubernetes workloads. This allows organizations to achieve the flexibility, scalability, and agility benefits of microservices today, without needing to first upgrade legacy infrastructure to Kubernetes.
Istio is purpose-built to provide service connectivity for Kubernetes environments, with limited support for non-Kubernetes infrastructure. Istio must be installed into a Kubernetes cluster. While possible to bridge bare metal, VMs, and legacy workloads with an Istio control plane, it requires special networking and load-balancers to connect that are not part of the service mesh. It may also impact IT security policies of least-privilege access control models, widening your risk blast radius.
Traffic Management
| Greymatter | Open Source Istio | |
|---|---|---|
| Can be deployed outside of Kubernetes | X | |
| Can bridge non-Kubernetes workloads | X | Limited |
| Dynamic scaling to thousands of nodes and billions of requests | X | |
| Front/edge proxying | X | X |
| Support for Ingress Gateways | X | X |
| Multi-mesh support | X | |
| Service discovery | X | X |
| Fault injection | X | X |
| Multi-cluster failover | X | Limited |
| Retries, circuit breakers, timeouts | X | X |
| Locality-based load balancing | X | |
| CORS and websockets | X | |
| Shape, shift, and transform traffic | X | X |
| Explicit application routing techniques | X |
Greymatter does simplify configuration management.
Connect to any app, API, database, or microservice, using the Greymatter Specification Language (GSL), a declarative DSL for application networking. When designing GSL our foundational goal was to improve the developer experience. Written in the CUE programming language, GSL streamlines and simplifies configuration pipelines for application networking components.
Our platform allows organizations to put our data plane in front of any workload and share the same configuration across environments. Platform engineers only manage a single, CUE-based config Git repository for each application to control every policy, such as service discovery, traffic routing, data encryption, etc. Using GSL mix-in objects, we turn common configuration challenges into easy reusable drop-in components. We have built-in support for automated GitOps workflows that supports modern CI/CD processes with rollback capabilities without the need for a third-party capability.
Open source Istio does not have any inherent governance pipeline or supply chain model from development to production. Istio requires multiple Kubernetes YAML config files per service. It is also tethered to the underlying Kubernetes API, which makes it harder to manage in live production environments at scale. Most importantly this tight coupling of infrastructure with application configuration breaks down at enterprise scale. It specifically kills adherence to separations of concern.
In conclusion, Istio is just a control plane that handles service to service connectivity, it requires third-party capabilities, scripts, and languages to implement any enterprise governed supply chain from development to production.
Governance
| Greymatter | Open Source Istio | |
|---|---|---|
| Declarative configuration DSL | X | |
| Simplified API abstracted from underlying infrastructure | X | |
| Application networking lifecycle management | X | |
| Configuration scaffolding | X | |
| Configuration expandability | X | |
| Configuration validation | X | |
| Configuration rollback | X | |
| GitOps built-in | X | |
| Blue/Green, canary deployment models | X | |
| No-interruption updates/upgrades | X | |
| Global-service naming management | X |
Greymatter is the most secure application networking platform.
Our platform is purpose-built with military-grade zero-trust security that meets or exceeds any organization’s use case. The Greymatter build pipeline produces FIPS 140-2 compliant builds of our platform. Our application networking platform facilitates user authentication, data encryption, certificate management & rotation, and policy compliance.
Greymatter implements the SPIFFE specification and automatically provisions SPIRE to provide strongly attested, cryptographic service identities to workloads across a wide variety of platforms. We have integrated identity-aware application networking into the Greymatter platform. This allows for synthesis with multiple enterprise identity management systems. It also handles granular certificate and token based auth N/Z, and user-based impersonation across the mesh segmentations, clusters, and clouds.
We have forensic user audit tracks for every transaction across your multi-cloud, hybrid environment. Applications, APIs, and data services wired through our platform are automatically compliant with NIST’s zero-trust architecture criteria out of the box. Greymatter has been certified to run up through Impact Level 6 (IL6+)-accredited environments and is Commercial Cloud Enterprise (C2E)-Ready.
Istio provides security capabilities such as TLS/mTLS encryption, support for external secrets management, and vulnerability patching. However, as depicted in the table below, it has significant gaps it must fill in order to be considered zero-trust. An enterprise must be prepared to pay significant costs to fill and maintain these gaps to achieve an end-to-end security architecture for applications, APIs, and data services.
Security Management
| Feature | Greymatter | Open Source Istio |
|---|---|---|
| TLS/mTLS | X | X |
| Multitenancy | X | |
| Federated trust domains | X | |
| Federated identity token management | X | |
| Next generation access control and delegation | X | |
| Open policy agent (OPA) policy as code | X | |
| Identity impersonation | X | |
| OIDC/OAuth | X | |
| External auth | X | |
| Certificate management | X | |
| Out of the box SPIFFE/SPIRE support | X | |
| Secrets management | X | X |
| Security and policy multi-cluster management | X | |
| Security score audits | X | |
| Data policy management | X | |
| Security governance supply chain management | X | |
| Live-user tracking | X | |
| FIPS (140-2) compliance | X | |
| NIST zero-trust compliance | X | |
| Vulnerability scanning and publications | X | X |
Greymatter drives decision-making & impact analysis using analytics.
Our platform provides lifecycle management for multi-cluster observability. In addition, it automates the provisioning of a metric and audit index used by our dashboard applications. We provide a rich collection of advanced observability, health-monitoring, and cataloging features. Likewise, our platform delivers critical multi-mesh, service, and user intelligence, cutting through the noise and alleviating developer cognitive load.
An elegant NOC/SOC-like dashboard presents easily digestible information designed to enable rapid operations and business decision making. We have introduced security scores and pattern analysis across your environment. Greymatter also supports out of the box integration with common tools used by platform engineering teams to include Grafana, Splunk, and the ELK stack. All of this leads to smarter, faster, and more informed performance optimization and cost-conscious decision-making.
In comparison, Istio has no user interface. Features like multi-cluster cataloging do not exist. Instead, it requires third-party capabilities for all visualization needed to collect and view metrics, distributed tracing, and alerting. Notably, each requires expert-level skill sets to set up, operate, and manage at scale. Yet, maintaining this combined set of capabilities is not trivial or low-cost. Instead, these are commodity capabilities that any service mesh-centered capability must deliver.
Application Networking Intelligence
| Feature | Greymatter | Open Source Istio |
|---|---|---|
| Auto-provisioning of necessary infrastructure to support metrics and audit collection | X | |
| Multi-mesh overwatch and visibility | X | |
| Application networking enterprise catalog | X | |
| Health checks (passive, active) | X | |
| Dependency health checks | X | |
| NOC/SOC array | X | |
| Lifecycle management for multi-cluster observability | X | |
| Support for Grafana | X | X |
| Tracing (with third-party) | X | X |
| Alerting (with third-party) | X | X |
| Sense-making and heuristics | X | |
| Support for third-party visualization capabilities | X | X |
Greymatter is built to run in production environments at scale.
Our platform is proven in the most demanding defense and intelligence environments worldwide. We ensure support for previous versions and necessary security patches of our application networking platform. Greymatter was built from a business-first perspective to address the governance, control, security, and visibility challenges that organizations face while deploying hundreds of apps, APIs, and microservices across hybrid and multi-cloud environments.
Greymatter is optimized for real-world, Day-2 operations based on ongoing customer requests to route traffic, secure communications, and monitor performance. Our product roadmap follows a regular software release schedule, with each product version guaranteed to maintain reliability, stability, and continuity.
Istio is an open source capability. Furthermore, it has limited support for previous software releases and a troublesome upgrade path, especially considering the number of augmented capabilities required to make a full enterprise solution. Istio customers must rely on the open-source community for bug fixes, feature requests, and implementation assistance, without dedicated and readily available customer support for broken code, construct changes, or ongoing usage challenges. Finally, Istio remains challenging to run in live, production environments at scale. This experimental deployment approach might work in development environments, but is not often the best fit for production environments.
Comprehensive Support
| Feature | Greymatter | Open Source Istio |
|---|---|---|
| Hybrid and Multi-cloud Support | X | Limited |
| Kubernetes native Support | X | X |
| Virtual Machine Support | X | Limited |
| Envoy Proxy | X | X |
| Windows Support (Native and WSL) | X | |
| ARM processors Support | X | |
| Long-term Vision Support | X | |
| CVE priority patching, version patching, graceful degradation, and back-porting | X | |
| Expert help through support channels | X | |
| Enterprise support | X | |
| Published SLAs | X |
Greymatter picks up where Istio leaves off.
Our platform is not theoretical. It just works. Greymatter is notably proven in complex, highly secure defense and intelligence environments worldwide. It also provides an enterprise-ready solution for implementing service mesh, as well as other necessary application networking capabilities.
Our platform was built to meet real world operational needs to control the complexity of enterprise software applications through improved observability, authentication, audit-ability, and security. Greymatter provides customers with the flexibility to deploy in any environment on their own schedule. As an enterprise proven partner, our customer success experts are always available to provide ongoing support and assurance that your hybrid and multi-cloud applications, APIs, and data service will run properly.
Interested in learning more about how Greymatter can help your team? We invite you to try our platform for 30 days! Contact us to learn how Greymatter.io can help your enterprise control complexity, secure applications and see real-time operations.
