Separate cluster network identity from IP addresses to secure and observe traffic
Imagine a scenario where you can instantly see where traffic in a cluster comes from, where it goes, and why it was blocked. Cilium restructures container networking with an eBPF-based data plane, enabling application-level policy enforcement and real-time monitoring. It allows you to manage network, security, and observability issues in a Kubernetes cluster with a single solution.
Data plane and load balancing restructured with eBPF
Cilium uses the Linux kernel's eBPF technology to dynamically insert logic into network I/O, sockets, and tracepoints. This allows security, networking, and visibility logic to be executed efficiently during packet processing. It replaces the existing kube-proxy, using eBPF hash tables to support large-scale service density and eliminating per-packet NAT overhead by rewriting service connections at the socket level. East-west traffic is optimized at the socket level, while north-south traffic utilizes XDP for high-throughput scenarios.
Identity-based security independent of IP addresses
Traditional container firewalls rely on IP addresses and ports, but Cilium assigns security identities to application container groups. This identity is associated with network packets and verified at the receiving node, remaining unaffected by IP address changes. L3/L4 policies restrict traffic by labels, protocols, and ports, while DNS-based policies allow or deny FQDNs or wildcard domains. L7 policies can filter by HTTP method, URL path, gRPC calls, and header presence, enabling fine-grained access control.
Multi-cluster connectivity and service mesh features
Cluster Mesh provides secure connections between multiple Kubernetes clusters, maintaining a consistent security experience in hybrid or multi-cloud environments. Global service discovery allows you to discover and connect to services in other clusters as if they were local, with automatic failover to backends in other clusters during outages. Service mesh features support transparent encryption using IPsec, WireGuard, and ztunnel, and are deeply integrated with the Kubernetes Gateway API to declaratively manage ingress, traffic splitting, and routing.
Observability and troubleshooting with Hubble
It integrates with monitoring systems like Prometheus and Grafana to handle metrics and alerts. It provides the specific reasons for blocked traffic, such as policy violations, port issues, or DNS lookup failures, enabling operators to diagnose problems quickly.
Things to check before deployment
Cilium supports AMD64 and AArch64 architectures and maintains stable releases for the last three minor versions. Since v1.13.0, all images include an SBOM in SPDX format. Snapshot and RC images for development and testing are not suitable for production use, so caution is required. It is dual-licensed under Apache License 2.0 and GPL v2/BSD 2-Clause, and you must select the appropriate mode among overlay, native routing, and flexible routing options for compatibility with existing infrastructure.
