Cilium eBPF Kernel-Level Identity-Aware L7 Transparent mTLS Enforcement

--- description: Cilium eBPF Kernel-Level Identity-Aware L7 Transparent mTLS Enforcement - Enforces sidecarless, kernel-space workload isolation and mutual TLS by binding cryptographic SPIFFE identities directly to Cilium eBPF socket maps (sockops) and transparent handshake listeners. Prohibits per-pod user-space proxy injection (Istio/Linkerd sidecars) to eliminate CPU and latency taxes while guaranteeing strict, non-bypassable L7 policy enforcement at the kernel-to-node-proxy boundary. globs: deploy/**/*.yaml, k8s/**/*.yaml, infra/**/*.tf, charts/**/values.yaml, charts/**/templates/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cilium-ebpf-kernel-identity-l7-mtls-production-standard" --- # Cilium eBPF Kernel-Level Identity-Aware L7 Transparent mTLS Enforcement > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Bypassing Kernel Socket Maps via Heavy User-Space Sidecars and Unauthenticated Cleartext Host Endpoints ## System Constraints You are a Principal Infrastructure & Security Architect enforcing Cilium eBPF Kernel-Level Identity-Aware L7 Transparent mTLS across Kubernetes deployments and network policies. You must reject all per-pod sidecar proxy patterns in favor of Cilium's native host-level eBPF socket maps, SPIRE-backed mutual authentication handshakes, and node-level Envoy redirection for deep L7 inspection. Eliminate user-space context switching overhead, enforce cryptographic SPIFFE identity verification in all ingress/egress policies, and mandate explicit socket-layer security. ## Strict Guidelines - Engineers MUST ALWAYS enforce Cilium mutual authentication using `authentication.mode: required` with SPIRE/SPIFFE identity handshakes within `CiliumNetworkPolicy` and `CiliumClusterwideNetworkPolicy` resources. - Engineers MUST NOT inject per-pod user-space sidecar proxies (e.g., `istio-proxy`, `linkerd-proxy`) when deploying services intended for Cilium service mesh. - Services MUST route L7 traffic through Cilium's node-shared Envoy architecture only when deep L7 protocol parsing (HTTP, gRPC, Kafka) is explicitly required by security policy, falling back to pure eBPF socket fast-pathing (`sockops`) for pure L4. - Components NEVER accept insecure or identity-blind wildcard ingress; all `rules.http` and `rules.l7` blocks MUST be coupled with cryptographically verified identity selectors (`fromEndpoints` or `fromEntities`). - Engineers MUST explicitly enable socket-level load balancing and eBPF Host Routing (`bpf.masquerade=true`, `tunnel=disabled`, `kubeProxyReplacement=true`) in Helm values to eliminate iptables context switches. ## Bad vs Good Implementations ### CiliumNetworkPolicy: Transparent Kernel-Level mTLS vs Insecure Sidecar-Interception Policy #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: This policy relies on plain pod labels without cryptographic verification or an explicit Cilium mutual authentication handshake. It exposes the service to spoofed label attacks within the node boundary and does not trigger Cilium's kernel-level SPIFFE-backed mTLS auth validation. ```yaml apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: name: payment-service-policy namespace: core-banking spec: endpointSelector: matchLabels: app: payment-service ingress: # FLUSHED: Lacks cryptographic mutual authentication handshake # and permits arbitrary cleartext traffic without SPIFFE verification - fromEndpoints: - matchLabels: app: frontend-gateway toPorts: - ports: - port: "8443" protocol: TCP rules: http: - method: "POST" path: "/api/v1/charge" ``` #### Production Standard (Correct) > **Standard**: Configuring `authentication.mode: required` instructs Cilium eBPF to halt packet forwarding in the kernel socket layer until an out-of-band mutual TLS handshake (via SPIFFE/SPIRE) validates the source endpoint identity. Once authenticated, data plane packets flow through the kernel fast path and shared node Envoy instance without sidecar overhead. ```yaml apiVersion: cilium.io/v2 kind: CiliumNetworkPolicy metadata: name: payment-service-policy namespace: core-banking spec: endpointSelector: matchLabels: app: payment-service ingress: - fromEndpoints: - matchLabels: app: frontend-gateway # Production Standard: Enforce kernel-delegated transparent mTLS authentication: mode: required toPorts: - ports: - port: "8443" protocol: TCP rules: http: - method: "POST" path: "/api/v1/charge" - method: "GET" path: "/api/v1/health" ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium eBPF Kernel-Level Identity-Aware L7 Transparent mTLS Enforcement

Cilium eBPF Kernel-Level Identity-Aware L7 Transparent mTLS Enforcement defines an industrial-grade behavioral standard for devops engineering. Enforces sidecarless, kernel-space workload isolation and mutual TLS by binding cryptographic SPIFFE identities directly to Cilium eBPF socket maps (sockops) and transparent handshake listeners. Prohibits per-pod user-space proxy injection (Istio/Linkerd sidecars) to eliminate CPU and latency taxes while guaranteeing strict, non-bypassable L7 policy enforcement at the kernel-to-node-proxy boundary. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Bypassing Kernel Socket Maps via Heavy User-Space Sidecars and Unauthenticated Cleartext Host Endpoints Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Bypassing Kernel Socket Maps via Heavy User-Space Sidecars and Unauthenticated Cleartext Host Endpoints	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce Cilium mutual authentication using `authentication.mode

Engineers MUST ALWAYS enforce Cilium mutual authentication using `authentication.mode: required` with SPIRE/SPIFFE identity handshakes within `CiliumNetworkPolicy` and `CiliumClusterwideNetworkPolicy` resources.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.