Transparent, on-demand route determination and delegated authorization in a large-scale, decentralized service mesh

A method, comprising:

• intercepting, by a kernel-space application of a system comprising at least one processor, a call from a microservice that is directed to a remote endpoint that is external to a decentralized service mesh architecture that comprises the microservice;
• performing, by the kernel-space application, an authorization check on the call based on an identification of the microservice and a virtual address of the remote endpoint identified in the call, to produce an authorization result;
• determining, by the kernel-space application, connectivity information of the remote endpoint based on the virtual address;
• and
• relaying, by the kernel-space application, network traffic between the microservice and the remote endpoint, based on the authorization result indicating that the call is authorized and using the connectivity information.

A non-transitory computer-readable medium comprising instructions that, in response to execution, cause a system comprising at least one processor to perform operations, comprising:

• intercepting, by a kernel-space application, a call from a user-space application that is directed to a remote endpoint;
• authorizing, by the kernel-space application, the call based on an identification of the user-space application and a virtual address of the remote endpoint identified in the call, to produce an authorization result;
• determining, by the kernel-space application, connectivity information of the remote endpoint based on the virtual address;
• and
• relaying, by the kernel-space application, network traffic between the user-space application and the remote endpoint, based on the authorizing of the call and using the connectivity information.