Cilium

Definition

Cilium is an open-source networking, observability, and security project for Kubernetes and other cloud-native environments, built on the Linux kernel technology eBPF. It provides pod networking, network policy enforcement, load balancing, and deep traffic visibility by running programs directly in the kernel rather than relying on traditional iptables-based packet filtering, which lets it operate with lower overhead at higher scale.

Overview

Cilium emerged as Kubernetes networking needs outgrew what traditional Linux networking primitives could efficiently support. Early Kubernetes network implementations commonly relied on iptables rules to enforce network policy and route traffic, but iptables rule sets grow linearly with the number of services and pods, causing performance to degrade as clusters scale into the thousands of workloads. Cilium was built around eBPF, a Linux kernel technology that allows sandboxed programs to run directly inside the kernel, to address that scaling limitation from the ground up. Rather than optimizing the existing iptables model incrementally, Cilium's founders chose to rebuild the networking data path on a fundamentally different kernel mechanism. Mechanically, Cilium attaches eBPF programs at various points in the Linux networking stack to handle packet forwarding, load balancing, and policy enforcement without the overhead of traversing long iptables chains. Because these programs run in the kernel, Cilium can implement Kubernetes network policies, encrypt pod-to-pod traffic, and perform load balancing with much lower latency and CPU cost at scale than iptables-based approaches. It also exposes rich network flow visibility through Hubble, a companion observability component that captures the same eBPF-derived data to show identity-aware traffic flows between services. Cilium is often compared to other Kubernetes networking plugins that implement the Container Network Interface, such as Calico or Flannel, and to service mesh proxies like Envoy that operate at a higher layer. Compared to iptables-based CNI plugins, Cilium's eBPF foundation gives it a performance and scalability advantage as cluster size grows. It also increasingly overlaps with service mesh functionality, offering some of what a sidecar proxy mesh provides, like Layer 7 policy and mutual TLS, without requiring a sidecar container in every pod. In practice, platform teams adopt Cilium as their Kubernetes CNI when running large, high-traffic clusters where iptables-based networking becomes a scaling bottleneck, when they need identity-aware network policies that go beyond IP-based rules, or when they want deep network observability without deploying a separate service mesh. Cilium is also used as the data plane underneath some managed Kubernetes networking offerings. The trade-off is that eBPF-based networking requires a sufficiently recent Linux kernel and carries a steeper operational learning curve than simpler CNI plugins, since debugging kernel-level packet processing differs from familiar iptables troubleshooting. Smaller clusters without scaling or advanced policy needs may not need Cilium's added capability and could run a simpler CNI plugin instead. Cilium's advantages become most apparent as cluster size, traffic volume, and policy complexity grow beyond what a simpler networking layer can comfortably handle.

Key Features

• eBPF-based data plane replacing traditional iptables packet filtering
• Kubernetes network policy enforcement with identity-aware rules
• Built-in load balancing implemented at the kernel level
• Hubble component providing deep, flow-level network observability
• Transparent encryption of pod-to-pod traffic
• Layer 7 policy capabilities overlapping with service mesh features
• Designed to scale efficiently in large, high-traffic clusters

Use Cases

Alternatives

Frequently Asked Questions

Related in DevOps