What is Cilium eBPF for security and networking?

Question

Accepted Answer

**Cilium** — CNI plugin based on eBPF, replacing iptables/kube-proxy.

**eBPF advantages:**
- Performance: O(1) instead of O(n) iptables rules.
- L7 visibility: HTTP, gRPC, Kafka.
- Kernel programmability without recompilation.

**Installation:**
```bash
helm repo add cilium https://helm.cilium.io/
helm install cilium cilium/cilium \
  --namespace kube-system \
  --set kubeProxyReplacement=true \
  --set hubble.enabled=true \
  --set hubble.relay.enabled=true \
  --set hubble.ui.enabled=true
```

**L7 NetworkPolicy:**
```yaml
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: api-policy
spec:
  endpointSelector:
    matchLabels:
      app: api
  ingress:
    - fromEndpoints:
        - matchLabels:
            app: frontend
      toPorts:
        - ports:
            - port: "8080"
              protocol: TCP
          rules:
            http:
              - method: GET
                path: "/api/v1/.*"
              - method: POST
                path: "/api/v1/orders"
                headers:
                  - "Content-Type: application/json"
```

**Hubble (observability):**
```bash
# Network flow
hubble observe --namespace production
hubble observe --to-pod production/api
hubble observe --protocol http

# Policy verdicts
hubble observe --type verdict
```

**CiliumService (replacement for kube-proxy):** Faster for large clusters (10k+ services).

DevOps: What is Cilium eBPF for security and networking?