Architectural Invariant Design: Cilium eBPF Host-Routing & Socket Bypass Invariant
Cilium eBPF Host-Routing & Socket Bypass Invariant defines an industrial-grade behavioral standard for devops engineering. Enforces architectural compliance when deploying Cilium with eBPF host-routing and socket-layer switching (sockops) enabled. Because socket-level load balancing short-circuits kernel TCP/IP networking directly at the sock_ops level, traditional Netfilter/iptables rules, conntrack, and veth packet captures are bypassed, requiring security policies, egress controls, and telemetry to be declared via eBPF-native primitives. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.
Hazard Analysis: What Breaks Without This Rule
The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:
| Failure Mode | AI Symptom (The Anti-Pattern) | Severity | Production Impact & Remedy |
|---|---|---|---|
| AI Hallucination & Deprecation Drift | Deploying Cilium eBPF socket bypass while relying on legacy iptables, conntrack, or veth-level packet capture for security enforcement. | Critical | Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository. |
| Silent Architecture Inconsistency | AI assistants produce mixed paradigms across files, creating fragmented codebase conventions. | Medium | Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails. |
Step-by-Step Production Directives
Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:
Engineers MUST ALWAYS enforce network segmentation via CiliumNetworkPolicy or CiliumClusterwideNetworkPolicy instead of host-level iptables or legacy third-party packet filters.
Engineers MUST ALWAYS enforce network segmentation via CiliumNetworkPolicy or CiliumClusterwideNetworkPolicy instead of host-level iptables or legacy third-party packet filters.
Engineers MUST NOT rely on iptables PREROUTING, POSTROUTING, or FORWARD chains for inter-pod routing or security controls when Cilium eBPF host routing is enabled.
Engineers MUST NOT rely on iptables PREROUTING, POSTROUTING, or FORWARD chains for inter-pod routing or security controls when Cilium eBPF host routing is enabled.
Code SHOULD explicitly declare Hubble and Tetragon integrations when L4/L7 audit logging or deep visibility is required, as socket bypass evades veth-level packet sniffers.
Code SHOULD explicitly declare Hubble and Tetragon integrations when L4/L7 audit logging or deep visibility is required, as socket bypass evades veth-level packet sniffers.
Services MUST configure 'cgroup.autoMount.enabled=true' and ensure cgroup v2 compatibility when enabling sockops to prevent silent fallback to non-optimized transport paths.
Services MUST configure 'cgroup.autoMount.enabled=true' and ensure cgroup v2 compatibility when enabling sockops to prevent silent fallback to non-optimized transport paths.
Components NEVER assume sidecar proxies (e.g., Istio, Linkerd) capture traffic via iptables redirects unless Cilium is configured to cooperate with sidecars using socket-level cgroup awareness or native Cilium Service Mesh.
Components NEVER assume sidecar proxies (e.g., Istio, Linkerd) capture traffic via iptables redirects unless Cilium is configured to cooperate with sidecars using socket-level cgroup awareness or native Cilium Service Mesh.
Frequently Asked Technical Questions
Common questions developers face when configuring AI coding assistants for this stack:
Q:Why is Cilium eBPF Host-Routing & Socket Bypass Invariant critical for AI coding assistants?
Enforces architectural compliance when deploying Cilium with eBPF host-routing and socket-layer switching (sockops) enabled. Because socket-level load balancing short-circuits kernel TCP/IP networking directly at the sock_ops level, traditional Netfilter/iptables rules, conntrack, and veth packet captures are bypassed, requiring security policies, egress controls, and telemetry to be declared via eBPF-native primitives. Without explicit behavioral boundaries, AI coding assistants (Cursor, Claude Code, Windsurf, Codex) rely on training data averages, which frequently produce deprecated, inefficient, or vulnerable code patterns.
Q:How does adopting this rule prevent AI hallucinations?
This rule explicitly declares what the AI must avoid (Deploying Cilium eBPF socket bypass while relying on legacy iptables, conntrack, or veth-level packet capture for security enforcement.) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.
Q:Which AI coding environments are supported?
This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).
Q:Can I combine this rule with other technology stacks?
Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.