Tetrate Enterprise Gateway for Envoy—the cloud-native service gateway—has reached 1.0!

Learn more › close
Tetrate Enterprise ready service mesh
Get Demo
Pricing

How Tetrate Service Bridge Works

A service mesh enables developers to separate and manage service-to-service communications in a dedicated infrastructure layer, making them fast, reliable and secure.

Get a demo
Tetrate Service Express for EKS

Application Edge and Cluster Interconnectivity

Tetrate Service Bridge sits at the application edge, at cluster ingress and between workloads in your Kubernetes and traditional compute clusters. Edge and ingress gateways route and load balance application traffic across clusters and clouds while the service mesh controls connectivity between services.

Application Edge and Cluster Interconnectivity
Get a demo

Application Networking and Security for Any Workload

Tetrate Service Bridge is an Istio-based service mesh and control plane that unifies the configuration, operation and visibility of service-to service connectivity within distributed applications.

  • Global Management Plane

  • Universal Traffic Management

  • Zero Trust Security and FIPs Compliance

  • Multi-Tenant Workspaces

  • Unified & Consistent Observability

A central management plane coordinates policy, configuration, observability, workflows and lifecycle across all your cloud native and distributed applications. Multi-cluster out of the box to coordinate app connectivity across all of your infrastructure—multi-cluster, multi-cloud, on-premises—from a single point of management.

Management Plane for Istio

Management Plane for Istio

Manage multiple instances of Istio and Envoy, coordinating their configuration to apply security and traffic policies consistently across all of your entire  application fleet.

A central management plane coordinates policy, configuration, observability, workflows and lifecycle across all your cloud native and distributed applications. Multi-cluster out of the box to coordinate app connectivity across all of your infrastructure—multi-cluster, multi-cloud, on-premises—from a single point of management.

Comprehensive Istio & Envoy lifecycle management

Comprehensive Istio & Envoy lifecycle management.

Manage centrally and upgrade incrementally with a full inventory of your mesh deployments, versions and current state. Platform owners can manage the lifecycle of Istio and Envoy consistently and safely across their entire fleet.

A central management plane coordinates policy, configuration, observability, workflows and lifecycle across all your cloud native and distributed applications. Multi-cluster out of the box to coordinate app connectivity across all of your infrastructure—multi-cluster, multi-cloud, on-premises—from a single point of management.

Global Service Discovery and Inventory.

Global Service Discovery and Inventory.

Gain deep insight into all the services in your system wherever they’re running – in cloud-native or legacy environments – including dependencies, behavior, real-time health and ownership. View and manage applications in your data centers and the cloud with a consistent set of tools and processes.

A central management plane coordinates policy, configuration, observability, workflows and lifecycle across all your cloud native and distributed applications. Multi-cluster out of the box to coordinate app connectivity across all of your infrastructure—multi-cluster, multi-cloud, on-premises—from a single point of management.

Workflows and Process Integration.

Workflows and Process Integration.

Build workflows to match your existing business processes to fit cleanly into modern infrastructure-as-code and CI/CD practices while incrementally modernizing your applications. Your teams execute at their own pace, but safely within the guardrails you’ve provided.

A central management plane coordinates policy, configuration, observability, workflows and lifecycle across all your cloud native and distributed applications. Multi-cluster out of the box to coordinate app connectivity across all of your infrastructure—multi-cluster, multi-cloud, on-premises—from a single point of management.

Configuration Safeguards

Configuration Safeguards.

Author and validate Istio configuration ensuring correctness by construction. Service-level isolation and organizational controls guarantee that only correct configuration reaches your runtime.

A central management plane coordinates policy, configuration, observability, workflows and lifecycle across all your cloud native and distributed applications. Multi-cluster out of the box to coordinate app connectivity across all of your infrastructure—multi-cluster, multi-cloud, on-premises—from a single point of management.

Unified Management across Any Environment.

Unified Management across Any Environment.

Single, unified management plane across Kubernetes clusters, virtual machines and bare metal servers. Manage workload no matter where the are located; on-prem, AWS, Azure, Google Cloud, Red Hat, VMware or other environments.

Tetrate Service Bridge manages traffic at the application edge, at cluster ingress, and between workloads in your Kubernetes and traditional compute clusters. Edge and ingress gateways route and load balance application traffic across clusters and clouds while the mesh controls connectivity between services.

Tetrate Service Bridge speeds your cloud migration efforts by allowing you to incrementally migrate services by providing seamless connectivity between legacy and modern workloads..

Traffic management in any environment

Unify and simplify traffic management at the application edge, at cluster ingress, and between workloads, eliminating the difference between north-south and east-west traffic.

Tetrate Service Bidge manages traffic at the application edge, at cluster ingress, and between workloads in your Kubernetes and traditional compute clusters. Edge and ingress gateways route and load balance application traffic across clusters and clouds while the mesh controls connectivity between services.

Tetrate Service Bridge accelerates cloud migration by allowing you to incrementally migrate services by providing seamless connectivity between legacy and cloud-native workloads.

Application edge routing and failover

Easily implement L7 load balancing across one or more ingress gateways in different clusters over Istio-controlled mTLS.

Tetrate Service Bridge manages traffic at the application edge, at cluster ingress, and between workloads in your Kubernetes and traditional compute clusters. Edge and ingress gateways route and load balance application traffic across clusters and clouds while the service mesh controls connectivity between services.

Tetrate Service Bridge accelerates cloud migration efforts by enabling you to incrementally migrate services by providing seamless connectivity between legacy and modern workloads.

Application ingress

Eliminate the difference between north-south and east-west traffic. There is just application traffic. So, our out-of-the box API gateway functionality may be applied at every layer: the application edge, application ingress, and between services at the mesh sidecar.

TSB manages traffic at the application edge, at cluster ingress, and between workloads in your Kubernetes and traditional compute clusters. Edge and ingress gateways route and load balance application traffic across clusters and clouds while the mesh controls connectivity between services.

TSB speeds your cloud migration efforts by enabling you to incrementally migrate services by providing seamless connectivity between traditional and modern workloads.  Embrace cloud–public, private, and hybrid–faster, too.

Service to Service Communication

Manage cluster ingress and egress across Kubernetes clusters, VMs, and legacy applications. Easily configure:

  • Identity-based authentication and authorization
  • Load balancing and failover policies (HTTP, gRPC, WebSocket, and TCP traffic)
  • Fine-grained control of traffic behavior with rich routing rules, retries, failovers, and fault injection
  • Centralize policy for access controls, rate limits and quotas
  • Enforce authentication, authorization, and encryption

TSB manages traffic at the application edge, at cluster ingress, and between workloads in your Kubernetes and traditional compute clusters. Edge and ingress gateways route and load balance application traffic across clusters and clouds while the mesh controls connectivity between services.

TSB speeds your cloud migration efforts by enabling you to incrementally migrate services by providing seamless connectivity between traditional and modern workloads.  Embrace cloud–public, private, and hybrid–faster, too.

Extensible and Customizable Envoy Application Gateway

Easily extend Envoy Proxy capabilities to enhance security, reliability, filtering, transformations, and routing:

  • OpenAPI: configure gateways and mesh with your OpenAPI spec
  • CORS policy configuration
  • Web application firewall (WAF)
  • Authn/z. mTLS, OIDC, JWT, IP black/whitelist, and external auth
  • Credential management
  • Fault tolerance: timeout retry, circuit breaker
  • Transforms: custom header and body transformations for both request and response
  • Wasm: deploy custom Wasm filters to Envoy

Zero trust security has emerged as the preferred approach for enterprises to secure both their traditional and modern, cloud-native applications. Zero trust network architecture inverts the assumptions of perimeter security. In a zero trust network, every resource is protected internally as if it were exposed to the open internet. Tetrate Service Bridge provides a zero trust security model that ensures data and resources are inaccessible by default, eliminating the older perimeter model for security. With TSB, a zero trust architecture results in higher overall levels of security, plus reduced security complexity and operational overhead. TSB makes it easy to control who in your organization can change what, audit those changes, and ensure your mesh deployment conforms to secure best practices.

Zero Trust by Design

Tetrate Service Bridge enables you to apply security policy consistently in the mesh so app devs don’t have to. Get out-of-the-box conformance with NIST standards for microservices security and enable zero trust

In addition, features like app-level zoning allow for secure, fine-grained segmentation. Vetted workflows allow application, platform and infosec teams to effectively manage policies for the entire organization. A centralized view of config changes with policy controls enable audits and continuous proof of compliance.

Zero trust security has emerged as the preferred approach for enterprises to secure both their traditional and modern, cloud-native applications. Zero trust network architecture inverts the assumptions of perimeter security. In a zero trust network, every resource is protected internally as if it were exposed to the open internet. Tetrate Service Bridge provides a zero trust security model that ensures data and resources are inaccessible by default, eliminating the older perimeter model for security. With TSB, a zero trust architecture results in higher overall levels of security, plus reduced security complexity and operational overhead. TSB makes it easy to control who in your organization can change what, audit those changes, and ensure your mesh deployment conforms to secure best practices.

End-to-end mTLS

Implement encryption consistently and flexibly across all workloads, including between containers and VMs. Choose TLS version support based on corporate governance policy, not the capacity of your application teams. Tetrate Service Bridge integrates with your existing public key infrastructure––including ACM and Venafi––for centralized management.

Zero trust security has emerged as the preferred approach for enterprises to secure both their traditional and modern, cloud-native applications. Zero trust network architecture inverts the assumptions of perimeter security. In a zero trust network, every resource is protected internally as if it were exposed to the open internet. Tetrate Service Bridge provides a zero trust security model that ensures data and resources are inaccessible by default, eliminating the older perimeter model for security. With TSB, a zero trust architecture results in higher overall levels of security, plus reduced security complexity and operational overhead. TSB makes it easy to control who in your organization can change what, audit those changes, and ensure your mesh deployment conforms to secure best practices.

Next Gen Access Control

Tetrate’s built-in implementation of NIST’s next-generation access control (NGAC) provides for fine-grained, flexible segmentation, authentication and authorization. Move auth out of your applications to unburden your developers. Perform access control in Envoy between services to ensure consistent policy enforcement across your entire fleet and manage it all in one place.

Zero trust security has emerged as the preferred approach for enterprises to secure both their traditional and modern, cloud-native applications. Zero trust network architecture inverts the assumptions of perimeter security. In a zero trust network, every resource is protected internally as if it were exposed to the open internet. Tetrate Service Bridge provides a zero trust security model that ensures data and resources are inaccessible by default, eliminating the older perimeter model for security. With TSB, a zero trust architecture results in higher overall levels of security, plus reduced security complexity and operational overhead. TSB makes it easy to control who in your organization can change what, audit those changes, and ensure your mesh deployment conforms to secure best practices.

Vetted, FIPS compatible builds suitable for FedRAMP

Tetrate Service Bridge provides FIPS and federally certified builds, plus out-of-the box controls to ensure compliance with regulatory requirements. Audit log exports are also available to provide proof of current and historical adherence to governance and compliance standards.

Making service mesh work at scale requires the introduction of a few new concepts, especially requirements left unaddressed by Istio. Tetrate Service Bridge adds the concept of Workspaces to Istio, enabling organizations to group resources that can be managed together. Workspaces provide organizations with:
Replication of identity. Identity is preserved across all the clusters in the workspace, even when these clusters are in different namespaces and different infrastructure.
Configuration portability. As with identity, you use the same configuration on multiple namespaces and disparate infrastructure.
Flexibility. With workspaces, since multiple namespaces and multiple infrastructure locations are treated as one place, you can swap out namespaces and infrastructure without disruption to the application.
With Workspaces, organization can configure and manage resources without further concern as to the physical infrastructure or location they run on, which you might want to modify or replace over time.

Multi-tenancy

TSB creates logical views of your applications by grouping resources into a hierarchy of services, groups, workspaces, and tenants. This enables you to map your organization’s structure onto this resource hierarchy, making it easy to assign consistent policies and access rights so your people can safely access those resources. Use TSB’s fine-grained access control and isolation to apportion your shared infrastructure safely across teams. Map tenants – groups within your company – onto Istio clusters. The clusters used within a workspace may be in a single location per tenant, or distributed.

Making service mesh work at scale requires the introduction of a few new concepts, especially requirements left unaddressed by Istio. Tetrate Service Bridge adds the concept of Workspaces to Istio, enabling organizations to group resources that can be managed together. Workspaces provide organizations with:
Replication of identity. Identity is preserved across all the clusters in the workspace, even when these clusters are in different namespaces and different infrastructure.
Configuration portability. As with identity, you use the same configuration on multiple namespaces and disparate infrastructure.
Flexibility. With workspaces, since multiple namespaces and multiple infrastructure locations are treated as one place, you can swap out namespaces and infrastructure without disruption to the application.
With Workspaces, organization can configure and manage resources without further concern as to the physical infrastructure or location they run on, which you might want to modify or replace over time.

Role-based Access Control (RBAC)

Use workspaces to assign consistent security and compliance policies to groups of applications. You can also move and subdivide computing resources among hosts, including multiple public cloud providers and on-premises resources.

Connect TSB to an LDAP or OIDC server to create a live link to up-to-date employee directory information, including named groups such as departments and subsidiaries, that employees belong to. Audit changes to service and shared resources from start to finish.

Making service mesh work at scale requires the introduction of a few new concepts, especially requirements left unaddressed by Istio. Tetrate Service Bridge adds the concept of Workspaces to Istio, enabling organizations to group resources that can be managed together. Workspaces provide organizations with:
Replication of identity. Identity is preserved across all the clusters in the workspace, even when these clusters are in different namespaces and different infrastructure.
Configuration portability. As with identity, you use the same configuration on multiple namespaces and disparate infrastructure.
Flexibility. With workspaces, since multiple namespaces and multiple infrastructure locations are treated as one place, you can swap out namespaces and infrastructure without disruption to the application.
With Workspaces, organization can configure and manage resources without further concern as to the physical infrastructure or location they run on, which you might want to modify or replace over time.

Central Security Model

Workspaces provide a central location where the SecOps or other security teams to establish and manage traffic and security policies. These policies are automatically propagated to different teams enabling developers, application owners and architects to work more effectively.Workspaces provide a central location where the SecOps or other security teams to establish and manage traffic and security policies. These policies are automatically propagated to different teams enabling developers, application owners and architects to work more effectively.

Making service mesh work at scale requires the introduction of a few new concepts, especially requirements left unaddressed by Istio. Tetrate Service Bridge adds the concept of Workspaces to Istio, enabling organizations to group resources that can be managed together. Workspaces provide organizations with:
Replication of identity. Identity is preserved across all the clusters in the workspace, even when these clusters are in different namespaces and different infrastructure.
Configuration portability. As with identity, you use the same configuration on multiple namespaces and disparate infrastructure.
Flexibility. With workspaces, since multiple namespaces and multiple infrastructure locations are treated as one place, you can swap out namespaces and infrastructure without disruption to the application.
With Workspaces, organization can configure and manage resources without further concern as to the physical infrastructure or location they run on, which you might want to modify or replace over time.

Platform Team and DevOps

Developers and operators can both work at the workspace level; platform owners can modify the physical implementation as needed, with no impact on developers and minor impact on operators.

Making service mesh work at scale requires the introduction of a few new concepts, especially requirements left unaddressed by Istio. Tetrate Service Bridge adds the concept of Workspaces to Istio, enabling organizations to group resources that can be managed together. Workspaces provide organizations with:
Replication of identity. Identity is preserved across all the clusters in the workspace, even when these clusters are in different namespaces and different infrastructure.
Configuration portability. As with identity, you use the same configuration on multiple namespaces and disparate infrastructure.
Flexibility. With workspaces, since multiple namespaces and multiple infrastructure locations are treated as one place, you can swap out namespaces and infrastructure without disruption to the application.
With Workspaces, organization can configure and manage resources without further concern as to the physical infrastructure or location they run on, which you might want to modify or replace over time.

Workflows and process integration

Build workflows to match your existing business processes to fit cleanly into modern infrastructure-as-code and CI/CD practices while incrementally modernizing your applications

Tetrate service bridge consolidates observability data from across your infrastructure into a single, coherent picture allowing you to overcome performance and security visibility gaps caused by siloed clouds or heterogeneous runtimes.

TSB provides consistent observability data from all your applications and also integrate with third-party observability solutions. Empower teams and improve troubleshooting and SLAs with uniform visibility across your entire microservices environment and security posture.

Measure, correlate & remediate SLO violations

See the topology of your services and their dependency relationships to understand application health at a glance. Correlated metrics, traces, logs and lifecycle events make it easier to troubleshoot apps and reduce the mean time to identification and resolution.

Tetrate service bridge consolidates observability data from across your infrastructure into a single, coherent picture allowing you to overcome performance and security visibility gaps caused by siloed clouds or heterogeneous runtimes.

TSB provides consistent observability data from all your applications and also integrate with third-party observability solutions. Empower teams and improve troubleshooting and SLAs with uniform visibility across your entire microservices environment and security posture.

Consistent metrics from all apps at scale

Roll out global SLOs with consistent and unified app level metrics. Apache Skywalking under the  hood means data collection will scale efficiency with your apps.

Tetrate service bridge consolidates observability data from across your infrastructure into a single, coherent picture allowing you to overcome performance and security visibility gaps caused by siloed clouds or heterogeneous runtimes.

TSB provides consistent observability data from all your applications and also integrate with third-party observability solutions. Empower teams and improve troubleshooting and SLAs with uniform visibility across your entire microservices environment and security posture.

Single pane of glass for developers and SREs

Give app teams a view of their service topology and dependencies at a glance. Ensure alerts instantly reach the right teams so they can take action before it impacts a customer.

Tetrate service bridge consolidates observability data from across your infrastructure into a single, coherent picture allowing you to overcome performance and security visibility gaps caused by siloed clouds or heterogeneous runtimes.

TSB provides consistent observability data from all your applications and also integrate with third-party observability solutions. Empower teams and improve troubleshooting and SLAs with uniform visibility across your entire microservices environment and security posture.

Find out before there is an outage

Correlate measure and monitor both app and service level SLOs across your fleet. You can then recognize anomalies and take action.

See Tetrate Service Bridge in Action

  • Topology

  • Observability

  • Multi-cluster

  • Access Control

  • Traffic

    View traffic between services historically and in real time

  • Health

    View traffic between services historically and in real time

  • Metrics

    View connectivity metrics between services everywhere

  • Service Metrics

    Drill down to individual service metrics

  • Subset and Envoy Metrics

    Look at Envoy under the hood

  • Service Dependencies

    Inspect as-built service dependency graphs

  • Topology

    View cross-cluster traffic

  • Cluster Inventory

    View and manage configuration in every cluster

  • Configs

    View and manage configuration in every cluster

  • Resource level Policies

    Set auth policy for your org and view audit logs

  • Roles

    Configure roles based on your directory service

  • AuthN and AuthZ

    Configure authentication and authorization

Take the next step

Learn how we can help you scale service mesh success across your enterprise.

Contact us