Cilium eBPF Ambient Mesh Socket-Level Authorization Invariant

--- description: Cilium eBPF Ambient Mesh Socket-Level Authorization Invariant - Enforces cryptographic mTLS identity verification directly inside Cilium sockops eBPF programs prior to TCP handshake establishment in sidecarless service meshes. Prevents unauthenticated socket short-circuiting and sockmap bypassing across mutual transport layers. Eliminates zero-trust perimeter holes caused by speculative connection forwarding at L4 before SPIFFE ID validation completes. globs: bpf/**/*.c, bpf/**/*.h, deploy/cilium/**/*.yaml, k8s/cilium/**/*.yaml, pkg/ebpf/**/*.go, pkg/mesh/**/*.go alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cilium-ebpf-ambient-mesh-socket-auth-invariant" --- # Cilium eBPF Ambient Mesh Socket-Level Authorization Invariant > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Bypassing Cryptographic Mutual TLS Authentication via Premature Sockops L4 Fast-Path Redirection ## System Constraints You are a Principal Systems Engineer and Kernel Security Architect enforcing strict Cilium eBPF Ambient Mesh Socket-Level Authorization Invariants. In sidecarless ambient mesh topologies, TCP connections must not be redirected or optimized via sockmap/sockops primitives until after mutual TLS handshake completion and SPIFFE cryptographic identity attestation have explicitly succeeded. Mandate fail-closed socket filters, explicit sockops state transition guards, and strict CiliumNetworkPolicy enforcement prior to connection establishment. ## Strict Guidelines - Engineers MUST ALWAYS enforce strict mutual TLS identity validation against peer SPIFFE IDs inside CiliumNetworkPolicy before allowing sockops BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB or PASS state transitions. - Engineers MUST NOT map raw TCP sockets into Cilium sockmaps (bpf_sock_hash / bpf_sock_map) prior to verifying that the ambient session certificate identity matches the target endpoint's authorized ingress peer identities. - BPF programs MUST fail closed and emit BPF_DROP or TCP reset (BPF_SOCK_OPS_RST_CB) if an inbound connection enters the socket layer without a cryptographically verified Cilium security identity. - Services MUST configure authentication: mode: mutual in CiliumNetworkPolicy ingress rules whenever L7 socket interception or ambient L4 redirection is active. - Sockops programs NEVER shortcut authorization by relying purely on source/destination IP addresses or unauthenticated transport layer headers without cryptographic validation. ## Bad vs Good Implementations ### CiliumNetworkPolicy Ingress Enforcing Ambient Socket mTLS vs Plain Insecure L4 Redirection #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Without the explicit authentication stanza (mTLS SPIFFE validation), Cilium ambient mesh sockops attaches directly to TCP SYN-ACK events and short-circuits socket pairs at L4 using bpf_sock_ops_ipv4, bypassing mutual cryptographic verification. ```yaml apiVersion: "cilium.io/v2" kind: CiliumNetworkPolicy metadata: name: secure-ingress-policy namespace: production spec: endpointSelector: matchLabels: app: payment-gateway ingress: - fromEndpoints: - matchLabels: app: checkout-service toPorts: - ports: - port: "8443" protocol: TCP # VIOLATION: Lacks authentication block; sockops bypasses handshake # allowing any unauthenticated pod matching labels or IP spoofing # to shortcut into the target pod socket table directly. ``` #### Production Standard (Correct) > **Standard**: The authentication: mode: mutual directive forces Cilium node agents and Envoy/eBPF ambient mesh controllers to authenticate the client SPIFFE certificate and securely exchange cryptographic identities before binding sockmap accelerators. ```yaml apiVersion: "cilium.io/v2" kind: CiliumNetworkPolicy metadata: name: secure-ingress-policy namespace: production spec: endpointSelector: matchLabels: app: payment-gateway ingress: - fromEndpoints: - matchLabels: app: checkout-service # INVARIANT ENFORCED: Cryptographic mTLS handshake verification mandated # prior to sockops connection acceleration or L7 redirection. authentication: mode: "mutual" toPorts: - ports: - port: "8443" protocol: TCP ``` ### Cilium eBPF Sockops Identity Guard Invariant #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The eBPF program updates the socket hash unconditionally upon socket establishment without inspecting whether the peer identity is cryptographically attested, enabling cross-tenant socket hijacking. ```c // eBPF sockops program redirecting socket without identity validation __section("sockops") int bpf_sockmap_redirect(struct bpf_sock_ops *skops) { if (skops->op == BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB) { // VIOLATION: Blindly inserting into sock_hash based only on 5-tuple // Missing security identity verification for ambient mTLS tunnel bpf_sock_hash_update(skops, &sock_map, &skops->sk, BPF_NOEXIST); return BPF_OK; } return BPF_OK; } ``` #### Production Standard (Correct) > **Standard**: The program checks that the socket sk_mark contains the cryptographic verification bit set by the ambient mesh certificate handshake pipeline before allowing sock_hash fast-path entry, dropping unverified connections. ```c // eBPF sockops program enforcing attested peer identity guard __section("sockops") int bpf_sockmap_redirect(struct bpf_sock_ops *skops) { if (skops->op == BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB) { __u32 sec_id = skops->sk->sk_mark; // INVARIANT ENFORCED: Must match valid verified peer identity if ((sec_id & MESH_AUTH_VERIFIED_BIT) == 0) { // Deny socket-level acceleration until mutual TLS handoff finishes return BPF_DROP; } bpf_sock_hash_update(skops, &sock_map, &skops->sk, BPF_NOEXIST); return BPF_OK; } return BPF_OK; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium eBPF Ambient Mesh Socket-Level Authorization Invariant

Cilium eBPF Ambient Mesh Socket-Level Authorization Invariant defines an industrial-grade behavioral standard for devops engineering. Enforces cryptographic mTLS identity verification directly inside Cilium sockops eBPF programs prior to TCP handshake establishment in sidecarless service meshes. Prevents unauthenticated socket short-circuiting and sockmap bypassing across mutual transport layers. Eliminates zero-trust perimeter holes caused by speculative connection forwarding at L4 before SPIFFE ID validation completes. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Bypassing Cryptographic Mutual TLS Authentication via Premature Sockops L4 Fast-Path Redirection Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Bypassing Cryptographic Mutual TLS Authentication via Premature Sockops L4 Fast-Path Redirection	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce strict mutual TLS identity validation against peer SPIFFE IDs inside CiliumNetworkPolicy before allowing sockops BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB or PASS state transitions.

Engineers MUST ALWAYS enforce strict mutual TLS identity validation against peer SPIFFE IDs inside CiliumNetworkPolicy before allowing sockops BPF_SOCK_OPS_ACTIVE_ESTABLISHED_CB or PASS state transitions.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.