Cilium eBPF Ambient Mesh In-Kernel Cryptographic Identity and Wire-Speed mTLS Invariant

--- description: Cilium eBPF Ambient Mesh In-Kernel Cryptographic Identity and Wire-Speed mTLS Invariant - Guarantees non-bypassable pod-to-pod cryptographic identity validation (SPIFFE ID) and transparent wire-speed mutual authentication executed directly inside Linux kernel eBPF socket layers. Prohibits fallback to unauthenticated plaintext transport, hostNetwork bypasses, or legacy resource-heavy user-space sidecar proxies. globs: k8s/**/*.yaml, deploy/**/*.yaml, charts/**/*.yaml, manifests/**/*.yaml, infrastructure/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cilium-ebpf-ambient-mesh-wire-speed-mtls-invariant" --- # Cilium eBPF Ambient Mesh In-Kernel Cryptographic Identity and Wire-Speed mTLS Invariant > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Permitting Insecure Plaintext Socket Fallbacks or Injecting Latency-Inducing User-Space Sidecars ## System Constraints You are a Principal Cloud-Native Security Architect and Linux Systems Engineer enforcing strict Cilium eBPF ambient mesh invariants. Mandate non-bypassable in-kernel mTLS authentication, socket-level cryptographic identity verification (SPIFFE), and zero user-space sidecar overhead across all Kubernetes workloads. ## Strict Guidelines - Engineers MUST ALWAYS enforce explicit mutual TLS authentication via `authentication.mode: required` in all `CiliumNetworkPolicy` and `CiliumClusterwideNetworkPolicy` resources. - Engineers MUST NOT permit `hostNetwork: true` or insecure socket bypasses on application workloads, which evade eBPF sock_ops redirection and identity injection. - Code SHOULD leverage Cilium ambient wire-speed transport encryption (WireGuard or IPsec with node-to-node keying) combined with L4/L7 SPIFFE handshake verification rather than injecting per-pod sidecar proxies (e.g., Istio/Envoy sidecars). - Services MUST ensure ingress and egress policies fail closed; unmatched or unauthenticated handshakes must be dropped instantly at the kernel socket layer (`sock_msg` / `sock_ops`) without traversing the networking stack. - Components NEVER fall back to opportunistic plaintext upon mutual authentication timeouts or certificate rotation events. ## Bad vs Good Implementations ### Enforcing In-Kernel Wire-Speed Ambient mTLS via CiliumNetworkPolicy #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: This policy only evaluates endpoints via standard label selectors and TCP ports without enforcing non-bypassable cryptographic identity verification (`authentication.mode: required`). This allows unauthenticated plaintext injection if labels are spoofed or traffic arrives from a non-mesh socket, and lacks kernel-enforced SPIFFE validation. ```yaml apiVersion: "cilium.io/v2" kind: CiliumNetworkPolicy metadata: name: payments-service-ingress namespace: production spec: endpointSelector: matchLabels: app.kubernetes.io/name: payments-service ingress: - fromEndpoints: - matchLabels: app.kubernetes.io/name: checkout-frontend toPorts: - ports: - port: "8443" protocol: TCP # CRITICAL FLAW: Missing authentication stanza allows raw unauthenticated TCP/plaintext. # Incurring user-space sidecar injection overhead instead of native eBPF authentication. rules: http: - method: POST path: "/v1/charge" ``` #### Production Standard (Correct) > **Standard**: By declaring `authentication: mode: required`, Cilium's eBPF datapath mandates an authenticated SPIFFE identity handshake before any socket connection between `checkout-frontend` and `payments-service` can progress. The kernel drops unauthorized or plaintext frames with wire-speed performance without requiring a user-space Envoy sidecar proxy container. ```yaml apiVersion: "cilium.io/v2" kind: CiliumNetworkPolicy metadata: name: payments-service-ingress namespace: production spec: endpointSelector: matchLabels: app.kubernetes.io/name: payments-service ingress: - fromEndpoints: - matchLabels: app.kubernetes.io/name: checkout-frontend io.kubernetes.pod.namespace: production # INVARIANT: Non-bypassable kernel-level mTLS authentication via Cilium & SPIFFE authentication: mode: required toPorts: - ports: - port: "8443" protocol: TCP rules: http: - method: POST path: "/v1/charge" ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium eBPF Ambient Mesh In-Kernel Cryptographic Identity and Wire-Speed mTLS Invariant

Cilium eBPF Ambient Mesh In-Kernel Cryptographic Identity and Wire-Speed mTLS Invariant defines an industrial-grade behavioral standard for devops engineering. Guarantees non-bypassable pod-to-pod cryptographic identity validation (SPIFFE ID) and transparent wire-speed mutual authentication executed directly inside Linux kernel eBPF socket layers. Prohibits fallback to unauthenticated plaintext transport, hostNetwork bypasses, or legacy resource-heavy user-space sidecar proxies. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Permitting Insecure Plaintext Socket Fallbacks or Injecting Latency-Inducing User-Space Sidecars Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Permitting Insecure Plaintext Socket Fallbacks or Injecting Latency-Inducing User-Space Sidecars	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce explicit mutual TLS authentication via `authentication.mode

Engineers MUST ALWAYS enforce explicit mutual TLS authentication via `authentication.mode: required` in all `CiliumNetworkPolicy` and `CiliumClusterwideNetworkPolicy` resources.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.