Ananse is a lightweight, Go-native service mesh for Kubernetes. Transparent traffic interception, observability, and optional mTLS — without the operational weight of Istio or Linkerd.
# Add the Ananse Helm repo helm repo add ananse https://ananselabs.github.io/ananse helm repo update # Install into your cluster helm install ananse ananse/ananse \ --set-file caBundle=./ca.crt.b64 \ -n ananse-system --create-namespace
Ananse handles the plumbing — traffic interception, routing, and observability — so your services stay focused on business logic.
Mutating webhook automatically injects a sidecar proxy into labelled namespaces. Your pods need zero changes.
The control plane streams routing config to every proxy over gRPC. Updates propagate in milliseconds.
Metrics via Prometheus (PodMonitor per sidecar), logs via Loki/Promtail, and distributed traces via OpenTelemetry + Tempo — all linked in Grafana.
Mutual TLS between sidecars, enabled per-pod with a single annotation. Off by default — turn it on when you need it.
Kubernetes-native discovery, Consul for VM/Docker deployments, or static file config. One control plane, any backend.
Each sidecar runs at ~100m CPU / 64Mi memory. The full mesh adds minimal overhead to your cluster.
Numbers from a real production Kubernetes deployment running a sustained soak test — 50 concurrent users, 8 hours straight, no warmup exceptions.
The mesh was transparent throughout. Errors observed during the test originated from application-layer configuration (gateway connection pool), not the proxy — confirmed via per-pod Prometheus metrics.
Three components. No CRDs to learn. No separate CLI.
When a pod is created in a labelled namespace, the mutating webhook injects an init container and a sidecar proxy before the pod starts.
The init container writes iptables rules that redirect all inbound and outbound TCP traffic through the sidecar proxy on ports 15006 and 15001.
The sidecar subscribes to the control plane over gRPC. The control plane streams routing tables derived from Kubernetes service discovery.
The proxy handles TLS, metrics, and tracing transparently. Your app code talks to localhost — the proxy handles the rest.
Ananse works whether you're on Kubernetes or running containers on bare VMs.
One proxy per pod. The webhook handles injection automatically. Works with any CNI.
A single Ananse instance acts as an ingress gateway. Integrates with Consul for service discovery.
Every sidecar exposes Prometheus metrics on port 15021. Traces flow via OTLP gRPC. Loki captures logs with namespace/pod/container labels. All three link up in Grafana.
PodMonitor auto-discovers injected pods across all namespaces. Works with any Prometheus Operator install.
Promtail ships pod logs to Loki with namespace, pod, and container labels. Log lines link to traces via TraceID.
Sidecars emit OTLP spans to Tempo (or Jaeger). Grafana Tempo links traces back to Loki log lines. Enable filterHealthChecks to drop successful probe spans and keep Tempo clean.
helm install ananse ananse/ananse \ --set-file caBundle=./ca.crt.b64 \ --set observability.tracing.enabled=true \ --set observability.tracing.endpoint=tempo.monitoring.svc:4317 \ --set observability.tracing.filterHealthChecks=true \ -n ananse-system --create-namespace
Install Ananse, label your namespace, and your services join the mesh on next rollout.
helm repo add ananse https://ananselabs.github.io/ananse helm repo update
curl -sL https://raw.githubusercontent.com/ananselabs/ananse/main/scripts/generate-certs.sh | bash
helm install ananse ananse/ananse \ --set-file caBundle=./ca.crt.b64 \ -n ananse-system --create-namespace
kubectl label namespace default ananse.io/inject=enabled # Restart your workloads — sidecars inject automatically kubectl rollout restart deployment -n default