Cilium eBPF Ambient Mode Mutual Authentication & Cryptographic Identity Guardrail

--- description: Cilium eBPF Ambient Mode Mutual Authentication & Cryptographic Identity Guardrail - Enforces kernel-level mutual authentication and SPIFFE cryptographic identity validation directly on the eBPF datapath. Eliminates user-space sidecar proxy latency and memory footprint while guaranteeing strict zero-trust ingress and egress packet transit policies. globs: infra/**/*.ts, deploy/**/*.ts, cdk8s/**/*.ts, k8s/**/*.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cilium-ebpf-ambient-mutual-auth-standard" --- # Cilium eBPF Ambient Mode Mutual Authentication & Cryptographic Identity Guardrail > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Injecting user-space proxy sidecars or deploying permissive CiliumNetworkPolicies lacking kernel-level mutual authentication stanzas ## System Constraints You are a Principal Infrastructure Architect enforcing the Cilium eBPF Ambient Mode Mutual Authentication Standard. You mandate zero-latency, kernel-space packet attestation using Cilium's native mutual authentication infrastructure (SPIFFE/SPIRE). You strictly prohibit user-space sidecar proxy injection (e.g., legacy Envoy sidecars) for mTLS when Cilium eBPF is provisioned, and you require all pod-to-pod network policies to enforce explicit authentication handshake modes in the CiliumNetworkPolicy ingress and egress transit specifications. ## Strict Guidelines - Engineers MUST ALWAYS configure `spec.ingress[].authentication.mode: 'required'` in CiliumNetworkPolicy definitions to mandate eBPF auth map validation prior to packet transit. - Engineers MUST NOT configure legacy user-space sidecar injections (such as `sidecar.istio.io/inject: 'true'`) when deploying workloads in Cilium eBPF ambient mesh clusters. - Code MUST explicitly specify SPIFFE identity criteria (`spiffe://<trust-domain>/ns/<namespace>/sa/<serviceaccount>`) in authentication handshakes managed by Cilium Node Agent. - Services MUST enable transparent kernel encryption (WireGuard or IPsec) as an underlying transport safeguard when mutual authentication mandates packet payload confidentiality. - Components NEVER accept unauthenticated plaintext fallback paths; any dropped handshake packet must emit an alert via Cilium Hubble flow logs. ## Bad vs Good Implementations ### CiliumNetworkPolicy Mutual Authentication Declaration (CDK8s / TypeScript) #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: This configuration attempts to inject a legacy user-space sidecar proxy (introducing memory overhead and multi-millisecond latency penalties) and declares a CiliumNetworkPolicy without an `authentication` block, allowing unauthenticated packets through the eBPF datapath if proxy injection fails. ```typescript // BAD: Relies on user-space sidecar injection and lacks eBPF kernel-level mutual auth enforcement import { ApiObject } from 'cdk8s'; import { Construct } from 'constructs'; export class InsecureWorkloadPolicy extends Construct { constructor(scope: Construct, id: string) { super(scope, id); // Anti-pattern: Missing Cilium mutual authentication stanza; // relies on user-space proxy injection annotations or unauthenticated IP/port filters. new ApiObject(this, 'PaymentApiCnp', { apiVersion: 'cilium.io/v2', kind: 'CiliumNetworkPolicy', metadata: { name: 'payment-ingress-policy', annotations: { 'sidecar.istio.io/inject': 'true', // Anti-pattern: sidecar proxy latency overhead }, }, spec: { endpointSelector: { matchLabels: { app: 'payment-service' }, }, ingress: [ { fromEndpoints: [ { matchLabels: { app: 'checkout-frontend' } }, ], toPorts: [ { ports: [{ port: '8443', protocol: 'TCP' }], }, ], }, ], }, }); } } ``` #### Production Standard (Correct) > **Standard**: The good configuration removes user-space sidecar annotations and leverages Cilium's native ambient mutual authentication by configuring `authentication: { mode: 'required', type: 'spiffe' }`. The Cilium Node Agent performs the cryptographic handshake out-of-band and programs the eBPF auth map for zero-copy, sub-millisecond datapath packet attestation. ```typescript // GOOD: Eliminates sidecar proxies and mandates eBPF kernel-space mutual authentication with SPIFFE identity import { ApiObject } from 'cdk8s'; import { Construct } from 'constructs'; export class SecureAmbientAuthPolicy extends Construct { constructor(scope: Construct, id: string) { super(scope, id); new ApiObject(this, 'PaymentApiCnp', { apiVersion: 'cilium.io/v2', kind: 'CiliumNetworkPolicy', metadata: { name: 'payment-ingress-policy', namespace: 'payments', }, spec: { endpointSelector: { matchLabels: { 'app.kubernetes.io/name': 'payment-service' }, }, ingress: [ { fromEndpoints: [ { matchLabels: { 'app.kubernetes.io/name': 'checkout-frontend', 'k8s:io.kubernetes.pod.namespace': 'storefront', }, }, ], toPorts: [ { ports: [{ port: '8443', protocol: 'TCP' }], }, ], // Kernel-level eBPF authentication validation authentication: { mode: 'required', type: 'spiffe', }, }, ], }, }); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium eBPF Ambient Mode Mutual Authentication & Cryptographic Identity Guardrail

Cilium eBPF Ambient Mode Mutual Authentication & Cryptographic Identity Guardrail defines an industrial-grade behavioral standard for devops engineering. Enforces kernel-level mutual authentication and SPIFFE cryptographic identity validation directly on the eBPF datapath. Eliminates user-space sidecar proxy latency and memory footprint while guaranteeing strict zero-trust ingress and egress packet transit policies. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Injecting user-space proxy sidecars or deploying permissive CiliumNetworkPolicies lacking kernel-level mutual authentication stanzas Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Injecting user-space proxy sidecars or deploying permissive CiliumNetworkPolicies lacking kernel-level mutual authentication stanzas	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS configure `spec.ingress[].authentication.mode

Engineers MUST ALWAYS configure `spec.ingress[].authentication.mode: 'required'` in CiliumNetworkPolicy definitions to mandate eBPF auth map validation prior to packet transit.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.