Cilium eBPF Networking

Cilium is an open-source networking, observability, and security solution for cloud-native environments, powered by eBPF (extended Berkeley Packet Filter). Originally developed at Isovalent (founded by Thomas Graf and Dan Wendlandt, former Cisco engineers) and now a CNCF Graduated project, Cilium has over 21,000 stars as of 2026. Cilium leverages eBPF technology to insert powerful security, visibility, and networking control logic directly into the Linux kernel, enabling high-performance networking and security policies for Kubernetes and other container orchestration platforms without the overhead of traditional sidecar proxies or iptables rules. Key features include: eBPF-based networking (replacing kube-proxy with a more efficient eBPF implementation for Kubernetes service load balancing and routing, handling service connections entirely in kernel space without context switches), CNI plugin (providing container network interface with support for direct routing, overlay, and hybrid modes), layer 3/4/7 network policies (enforcing security policies at network, transport, and application layers with support for HTTP, Kafka, gRPC, and DNS protocol awareness), Hubble (a distributed observability platform built on Cilium providing real-time service map visualization, flow logs, and metrics for network traffic analysis), service mesh (Cilium Service Mesh providing L7 traffic management, mTLS encryption, and observability without sidecars via eBPF), ingress controller, Gateway API support, multi-cluster networking (Cluster Mesh connecting multiple Kubernetes clusters with transparent cross-cluster service discovery and routing), bandwidth management (per-pod bandwidth limiting via eBPF), and transparent encryption (IPsec or WireGuard-based encryption for node-to-node traffic).