What is Kubernetes Cilium Network Policy?

Question

Accepted Answer

**Cilium** — eBPF-based networking and security.

```yaml
# CiliumNetworkPolicy
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: l7-policy
  namespace: production
spec:
  endpointSelector:
    matchLabels:
      app: api
  ingress:
  - fromEndpoints:
    - matchLabels:
        app: frontend
    toPorts:
    - ports:
      - port: "8080"
        protocol: TCP
      rules:
        http:
        - method: "GET"
          path: "/api/.*"
        - method: "POST"
          path: "/api/users"
          headers:
          - "Content-Type: application/json"
  egress:
  - toEndpoints:
    - matchLabels:
        app: postgres
    toPorts:
    - ports:
      - port: "5432"
        protocol: TCP
      rules:
        kafka:
        - apiKey: "Produce"
          topic: "events"
---
# L7 HTTP policy
apiVersion: cilium.io/v2
kind: CiliumNetworkPolicy
metadata:
  name: http-allow
spec:
  endpointSelector:
    matchLabels:
      app: web
  ingress:
  - toPorts:
    - ports:
      - port: "80"
        protocol: TCP
      rules:
        http:
        - method: "GET"
          path: "/health"
        - method: "GET"
          path: "/static/.*"
```

```bash
# Cilium commands
cilium status
cilium policy get
cilium endpoint list
cilium l7list
cilium connectivity test
cilium hubble observe
```

**Cilium Features:**
- eBPF-based (high performance).
- L7 policies (HTTP, Kafka, DNS).
- Hubble (observability).
- Encryption (WireGuard/IPsec).

DevOps: What is Kubernetes Cilium Network Policy?