Cilium — eBPF-Powered Cloud Native Networking & Security

What it is

Cilium is an open-source cloud-native networking, observability, and security platform powered by eBPF (extended Berkeley Packet Filter). As a CNCF graduated project, it operates at the Linux kernel level to implement CNI, service mesh, and network policies without the overhead of traditional iptables-based solutions.

Cilium is designed for platform engineers and Kubernetes operators who need high-performance pod networking with deep L3-L7 visibility and policy enforcement.

How it saves time or tokens

Cilium replaces multiple separate tools. Instead of running a CNI plugin plus Istio for service mesh plus a separate network policy engine, Cilium handles all three in one eBPF-powered stack. The sidecar-free service mesh approach eliminates per-pod proxy overhead, reducing both resource consumption and operational complexity.

How to use

1. Install the Cilium CLI:

brew install cilium-cli

1. Install Cilium in your Kubernetes cluster:

cilium install
cilium status --wait

1. Verify connectivity:

cilium connectivity test

Example

# L7 network policy: allow only GET requests to /api/v1/public
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: allow-public-api
spec:
  endpointSelector:
    matchLabels:
      app: backend
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: frontend
      toPorts:
        - ports:
            - port: '8080'
              protocol: TCP
          rules:
            http:
              - method: GET
                path: '/api/v1/public'

Related on TokRepo

• DevOps tools — infrastructure and Kubernetes tooling
• Security tools — network security and policy enforcement resources

Common pitfalls

• Running Cilium on kernels older than 4.19 where eBPF features are incomplete
• Forgetting to remove the existing CNI plugin before installing Cilium, causing conflicts
• Enabling Hubble observability without allocating sufficient resources for the Hubble Relay component