How Skyward Mesh Secures Node Connectivity Without a Service Mesh
Private k3s clusters ship with flannel — unencrypted, flat networking. Connecting nodes across different networks requires manual WireGuard key management. The conventional fix, a service mesh like Istio or Linkerd, injects a sidecar proxy into every pod: hundreds of extra containers that consume RAM and add latency to every LLM inference call. Skyward Mesh solves this without sidecars: Cilium replaces kube-proxy with eBPF programs that run directly in the kernel — faster than iptables, with transparent WireGuard encryption between nodes — while Headscale automates WireGuard key exchange so any node joins the mesh with a single command, whether it is on the same LAN or separated by NAT.
The architecture
Headscale manages the WireGuard control plane; Cilium enforces network policy in the Linux kernel. Three nodes, zero sidecar proxies.
Headscale distributes WireGuard keys and assigns stable overlay IPs (100.x.x.x) to each node. Cilium runs as an eBPF program in the kernel — no iptables, no flannel VXLAN. The bottom panel shows the enforced access topology: Chat reaches Gate; Gate reaches the inference backend; no direct path exists from Chat to inference.
Stage by stage
Four stages take a vanilla k3s cluster from unencrypted flat networking to a fully encrypted, identity-enforced mesh with real-time observability.
Zero-config k3s setup
Install k3s with --flannel-backend=none --disable-kube-proxy. Cilium takes over
both roles: it manages pod IP allocation (IPAM) and handles all packet routing via
eBPF programs loaded directly into the Linux kernel. No iptables rules, no flannel
VXLAN tunnels.
Headscale node registration
Every k3s node runs a Tailscale client that points at a self-hosted Headscale control plane deployed inside the cluster. Headscale manages WireGuard public key exchange and assigns each node a stable overlay IP (100.x.x.x). New nodes register automatically — no manual key generation, no static config files to keep in sync.
eBPF NetworkPolicy
Cilium enforces the SkywardAI component topology at the kernel level with zero sidecar overhead. Only Skyward Gate can reach inference backends (Ollama / vLLM). Inference backends have no egress. Skyward Chat reaches only Skyward Gate. Policy violations are dropped before the packet ever leaves the kernel.
Hubble flow visibility
Hubble — Cilium's built-in observability plane — records per-flow network events without sampling. Skyward Console reads these metrics to show real-time service maps, blocked-flow alerts, and per-component request rates. No additional agent or log shipper required.