Cilium is a networking, security, and observability solution for Kubernetes built on eBPF, a Linux kernel technology that lets Cilium run networking and security logic directly in the kernel, without the overhead of traditional iptables-based approaches.

How it works

Cilium runs as a Kubernetes CNI (Container Network Interface) plugin, giving it visibility into every Pod’s network traffic. Because its data path is implemented in eBPF programs running in the kernel, it can enforce network policy, load-balance traffic, and encrypt Pod-to-Pod communication with far lower overhead than proxy- or iptables-based alternatives. It also works with identities (Pods, services) rather than just raw IP addresses.

Core concepts

• eBPF — a Linux kernel technology that lets Cilium attach custom programs to network events without kernel modules or out-of-tree patches.
• CiliumNetworkPolicy — an extended network policy resource supporting Layer 3–7 rules, including HTTP-aware rules such as restricting allowed API paths.
• Identity — Cilium assigns a security identity to groups of Pods sharing labels, so policy and observability are expressed in terms of workloads, not ephemeral IPs.
• Hubble — Cilium’s observability component, providing a live, flow-level view of network traffic and policy decisions across the cluster.

Why teams adopt Cilium

• Performance. eBPF-based data paths avoid the per-packet overhead of iptables chains, which matters at scale.
• Identity-aware policy. Network policies are defined in terms of workload identity and even application-layer semantics, not just IP/port tuples.
• Deep visibility. Hubble gives a real-time, per-flow view of traffic and policy enforcement across the cluster, useful for both debugging and auditing.
• Beyond the CNI. Cilium can also handle load balancing, replacing kube-proxy, and can extend into a service mesh data plane.

Getting started

Install Cilium as your cluster’s CNI (many managed Kubernetes offerings support it as a supported networking add-on), then define CiliumNetworkPolicy resources to control traffic between workloads. The guides below cover common policy patterns and getting visibility with Hubble.